I have been using CodeIgniter for two years and I am digging into penetration testing. I think that ActiveRecord does good job at preventing SQL injections, but is there any possibility of bypassing ActiveRecord's filter system by ASCII Encoded / Binary String SQL injection?

If it is possible, then how can I prevent ASCII Encoded / Binary String SQL injection?

  • The question in your title is not the same as your first question in the body since prevention is not the same as knowing if there is actually a vulnerability. I'm not familiar with CodeIgniter, but you might check the source code to see if it uses prepared statements. – HamZa Nov 8 '13 at 18:57
  • 2
    Encoding strings using MySQL's hexadecimal literals is just an exploitation technique when normal string literals cannot be used. You would use the same usual prevention techniques: proper formatting/quoting or paramererization as provided by prepared statements. – Gumbo Dec 28 '14 at 9:08

There are no known SQL injection vulnerabilities in the latest version of Code Igniter and the guys at EllisLabs try their best to provide fast patches for reported vulnerabilities. If you do discover a security vulnerability in the Active Record code, you should responsibly disclose it to the company developing the product. Otherwise, do not try to fix what is not broken, because you may end up ainserting vulnerabilities, rather than eliminating them.

Important note: Make sure you do not make exceptions with using Code Igniter, by constructing your own SQL syntax (especially when you use user supplied input)

$this->db->query("SELECT id FROM table WHERE column LIKE '%"."$search."'");

Or if you do, properly escape your variables using their predefined functions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.