I was told by someone on the network that MariaDB was not susceptible to blind SQL injection. I was not aware of this. Can anyone elaborate? I am using it on my server and was told not to switch to PDO because I did not have to worry about it.

  • Don't bet on it. Always sanitize your web application SQL statement.
    – mootmoot
    Oct 18 '17 at 7:32
  • 2
    The first google hit on MariaDB comes back with a little utility meant to specifically perform this type of exploitation. github.com/JohnTroony/Blisqy I doubt you will not be able to run Blind SQL on MariaDB, do you have any documentation on this or any articles? Would be interesting to read a bit more into it.
    – sir_k
    Oct 18 '17 at 7:50
  • Thank you, I do have some confusion in the realm of using federatedx with MariaDB. I am going to register for the M|18 MariaDB CONFERENCE. I am still looking for more information. Blind SQL injection is one of my only concerns. I just loaded it on one of my racks and have just started to play with it a bit. Cheers and thanks for the info. I will report back with my findings and hopefully with a new EDIT. Oct 18 '17 at 8:43
  • 1
    @ErnestABuffington if you have results, please post them as an Answer, and do not embed them into your question. Please read the FAQ on how to Ask and Answer on Stack Exchange.
    – schroeder
    Oct 18 '17 at 9:31
  • MariaDB itself mentioned Blind SQLi in my 2nd Google search hit (after Blisqy as my first) (slide 14): slideshare.net/MariaDB/… they also speak extensively about using prepared statements
    – schroeder
    Oct 18 '17 at 9:38

I find that hard to believe, and apparently so does MariaDB themselves (h/t @schroeder).

MariaDB is a fork of MySQL, and "intends to maintain high compatibility with MySQL, ensuring a drop-in replacement capability with library binary equivalency and exact matching with MySQL APIs and commands" according to Wikipedia. You can do blind SQL injection on MySQL, so why shouldn't you be able to do it on MariaDB?

In fact, the ability to do any sort of SQL injection is a vulnerability in the application and not in the database. So your choice of SQL database shouldn't really matter for this.

But anyway, let's say that the person who told you this is right (which they aren't). Would that mean you don't have to use PDO or prepared statements? No, no, no, a thousand times no. What about ordinary (non-blind) SQL injection? That is even more dangerous!

Long story short, just use PDO or prepared statements.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.