Let's imagine a website which allows users to Sign up and login only with their email address.

Is it possible to perform a second order SQL injection in that case?

1 Answer 1


It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it.

So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.

  • Yes but what if the application was only allowing emails as usernames?
    – Mico
    Jun 16, 2015 at 10:00
  • 2
    @Mico Then the question becomes "How perfect is your email filter?". Even valid email addresses could trigger SQL injection if it's directly injected. For example, a dash is a perfectly valid email address character, but produces a comment in SQL. Hence a double quote could be used in your example. Jun 16, 2015 at 10:04
  • 1
    @Mico It has nothing to do with "what type of data is allowed" but with "how is all the allowed data sanitised". Jun 16, 2015 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .