This question already has an answer here:

Somebody emailed me this morning informing me that they gained access to my clients MySQL database and offered to fix the issue in exchange for money. I've been doing some testing with a real estate listing site. The way the site is set-up it currently has property.php?estateID=103 and doing property.php?estateID=103 union select 1,useraccounts(),3,4,5,6,7 pulls an error back FUNCTION database_table.useraccounts does not exist and I am assuming that is what is helping this hacker gain access to my database. How can I prevent this? Will simple sanitize help? The database is MySQL 5.5.

marked as duplicate by tim, Community May 22 '17 at 15:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


The vulnerability you describe is called SQL injection. It can be prevented by using parameterized queries. In this specific case it is also a good idea to do input validation, to make sure estateID is a number. This site explains how to prevent SQL injection for several programming languages.

Not the answer you're looking for? Browse other questions tagged or ask your own question.