Let's imagine a website which allows users to Sign up and login only with their email address.

Is it possible to perform a second order SQL injection in that case?


It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it.

So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.

  • Yes but what if the application was only allowing emails as usernames? – Mico Jun 16 '15 at 10:00
  • 2
    @Mico Then the question becomes "How perfect is your email filter?". Even valid email addresses could trigger SQL injection if it's directly injected. For example, a dash is a perfectly valid email address character, but produces a comment in SQL. Hence a double quote could be used in your example. – Chris Murray Jun 16 '15 at 10:04
  • 1
    @Mico It has nothing to do with "what type of data is allowed" but with "how is all the allowed data sanitised". – Steve Dodier-Lazaro Jun 16 '15 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.