2

Let's assume we're building a SQL query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters " and ', will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using MySQLi prepare.

2

Yes.

There are other ways to get data from a database, or just do something malicious. One way of doing this is to select all the records from the database, using either SELECT * FROM TABLE users or SELECT * FROM TABLE users WHERE True and then filtering through the returned data to find the user that the attacker wanted.

Further, statements like DROP TABLE users are not caught under the double quotes system, and have pretty nasty effects.

  • I think OP meant SQL injection through string concatenation where Username and password would be attacker controllable. In that case none of your examples constitute an injection because they are still in quotes. Can you give other examples or clarify which setup you're talking about? – Artjom B. Jan 20 at 9:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.