Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.

Using URL site. example:

www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),CONCAT(0x71787a7171,(SELECT (ELT(9701=9701,1))),0x71767a6271,FLOOR(RAND(0)*2))X FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY X)a)

In my application, I am using prepared statmenets that queryParamString as a clear text into DB without any side effects.

My question:

  • Is there any best practices to sanitize the URL when PHP server receives a request to render the page.
  • Or any client-side practices?
  • Any pointers on how to prevent or how you would deal with this kind of attack
  • Define "Sanitize and insert". Are you using prepared queries? Jan 9, 2020 at 22:05
  • 1
    yes, updated the question Jan 9, 2020 at 22:08
  • Is the attack successful? If you use prepared statements, it should not be!
    – Anders
    Jan 10, 2020 at 10:35
  • nope as I mentioned in question select query inserted as clear text into db. Jan 10, 2020 at 17:46

2 Answers 2


Best practice, server and client-side: always, always sanitise your inputs, outputs, and use prepared statements.

You could look at using a WAF (web application firewall) which will detect attempted SQL attacks etc and offer a layer of protection and also customise responses if they are detected. Other than stopping an attacker via something like IP blacklisting, if you have an Internet-facing service then there will be malicious actors trying to attack. To prevent this, you need secure, well-written code, such as prepared statements.

  • thank you. Definitely WAF is a helpfull prevention mechanism. Thank you for suggestion Jan 10, 2020 at 18:58

Based on the query string, that is sqlmap, not scanning for a vulnerability, but extracting data, suggesting that there either is a vulnerability or it's a false positive. However it is using error based extraction, which is not very prone to false positives.

I suggest you investigate this further. Although you may be using parameterized queries (which is the best way to avoid sql injection) it is possible that there is a missed parameter in the code leaving a vulnerability open.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .