Somebody emailed me this morning informing me that they gained access to my clients MySQL database and offered to fix the issue in exchange for money. I've been doing some testing with a real estate listing site. The way the site is set-up it currently has property.php?estateID=103 and doing property.php?estateID=103 union select 1,useraccounts(),3,4,5,6,7 pulls an error back FUNCTION database_table.useraccounts does not exist and I am assuming that is what is helping this hacker gain access to my database. How can I prevent this? Will simple sanitize help? The database is MySQL 5.5.


The vulnerability you describe is called SQL injection. It can be prevented by using parameterized queries. In this specific case it is also a good idea to do input validation, to make sure estateID is a number. This site explains how to prevent SQL injection for several programming languages.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.