Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.
Using URL site. example:
www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),CONCAT(0x71787a7171,(SELECT (ELT(9701=9701,1))),0x71767a6271,FLOOR(RAND(0)*2))X FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY X)a)
In my application, I am using prepared statmenets that queryParamString as a clear text into DB without any side effects.
- Is there any best practices to sanitize the URL when PHP server receives a request to render the page.
- Or any client-side practices?
- Any pointers on how to prevent or how you would deal with this kind of attack