-4

I want to know what type of server facebook uses ? If they use sql server , then is it vulnerable to sql injection ? Are all sql servers vulnerable to sql injection ? I just want to know this information and i have no intention of hacking as i have just started reading sql injection attacks and defense book

closed as off-topic by dr jimbob, TildalWave, Xander, user10211, Mark Aug 2 '14 at 19:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – TildalWave, Community, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

2

Facebook uses a custom version of MySQL. The site is almost certainly not vulnerable, since it's basically the biggest target on the web and people have been attacking it for years, mostly without success.

SQL injection vulnerability isn't a weakness in a database, it's a weakness in the application using the database. An SQL engine's job is to execute SQL statements, and injection works by tricking an application into sending statements that the developer didn't intend it to.

  • Can sql injection be done only on sql servers? – kishan keswani Aug 2 '14 at 10:53
  • @hellruler - SQL injection by definition requires an SQL database (e.g., oracle, postgresql, sqlite, mysql, MSSQL, etc) and a badly designed application. (It doesn't require the microsoft product with the dumb name of "SQL Server", but better known as MSSQL.) Granted SQL injection is only one type of injection attack; you can have injection attacks on NoSQL databases, code injection in bash/shell/php scripts, etc. Anytime a statement is eval (or equivalent) that contains untrusted user input you are vulnerable to an injection attack. It's only SQL injection if its an SQL statement. – dr jimbob Aug 2 '14 at 12:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.