I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? I've tried to inject it myself but my connection just times out. Thanks.

$db = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);

$db->query("INSERT INTO Name(Name) VALUES ('$firstname')");

closed as off-topic by Neil Smithline, schroeder Dec 1 '15 at 20:36

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Unfortunately, we do not do code review. We can talk about concepts and approaches, but not about specific issues in specific code. – schroeder Dec 1 '15 at 19:52
  • Okay no problem. I thought it would be more relevant to post this here rather than Stack Overflow but I can try there instead. Thanks. – Josh Dec 1 '15 at 19:54
  • 1
    codereview.stackexchange.com :) – Ohnana Dec 1 '15 at 20:21

No, there is no sanitation or escaping of quotes found in your snippet assuming $firstname is user provided input. Nothing is stopping me from modifying your query. This OWASP article will explain how easy it would be and their example closely resembles what you are trying to do.

You should consider reading up on how to use prepared statements and filtering your input to harden your code.

  • Do you know why my connection times out when I attempt SQL injection? I have reviewed that page previously and tried to input 1' or '1' = '1 into my form which should be the easiest way to test, but I get a connection reset error in Google Chrome. – Josh Dec 1 '15 at 20:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.