Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
59 votes
6 answers
24k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
21 votes
2 answers
22k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
user avatar
28 votes
2 answers
8k views

MySQL Server Hardening

Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
  • 15.2k
22 votes
3 answers
12k views

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
  • 20.5k
3 votes
2 answers
3k views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
  • 61
15 votes
3 answers
13k views

SQL injection can bypass login but not drop table

I've setup a test environment for running some SQL Injection against my code and learning how to defend against it. I can bypass the login form using the following in the password field: ' OR ...
  • 3,178
10 votes
4 answers
4k views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
2 votes
1 answer
10k views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
  • 57
24 votes
4 answers
35k views

Is "Why Should You Avoid AES In MySQL?" true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
17 votes
5 answers
19k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
16 votes
3 answers
8k views

Can I recover a lost AES key?

I had encrypted 2 MySQL databases with AES_ENCRYPT in ECB 128 bit mode. Now I forgot my encryption key, but I have plain text (I have one database without encryption and same with encryption). How to ...
7 votes
1 answer
3k views

SQL Injection explain this query

' 1=1 GROUP BY CONCAT_WS ('~',version(), FLOOR(rand(0)*2)) having min(0) 1>> My first question is what is CONCAT function is being used for in this query 2>> And Why do we use having min(0) in here.
142 votes
24 answers
25k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
47 votes
5 answers
8k views

Password security in databases - today still best practice? [duplicate]

Possible Duplicate: Which password hashing method should I use? There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am completely new ...
  • 481
40 votes
6 answers
25k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
  • 519
28 votes
1 answer
11k views

Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
27 votes
12 answers
9k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
22 votes
7 answers
3k views

How to exploit the "PHP_MAGIC_QUOTES ON" vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
  • 16.1k
13 votes
2 answers
84k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
  • 315
11 votes
4 answers
15k views

Are MySQL's database files encrypted?

I'm trying to securely store user credentials in a MySQL database which is hosted on a different server than the application (the communication between the two is secure). I have initially assumed ...
  • 233
9 votes
3 answers
1k views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
8 votes
1 answer
3k views

SQL injection with single statement query

Suppose I had a vulnerable query like this: var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;'; For the purposes of this question, req.body.id could be any integer ...
8 votes
1 answer
5k views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
8 votes
7 answers
32k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
8 votes
4 answers
5k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf </...
  • 1,280
7 votes
2 answers
21k views

How to extract information using a SQL injection on PHP?

I'm new to SQL injections so please forgive me if this appear a little amateur. I was working on a website where I managed to bypass authentication and login as a normal user: username: ' OR 1 -- - ...
6 votes
3 answers
976 views

Making database code open source

I am building a web app. It is currently not open source, but I am considering making it open source, so that others can fix bugs, improve it, so that others are not suspicious of my motives (fun to ...
6 votes
2 answers
3k views

What is better salted hash or openssl encryption?

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
6 votes
1 answer
7k views

How to bypass mysql_real_escape_string to exploit a SQLi vulnerability?

I tried to find some SQL injection exploits that could bypass functions that should prevent sql injection vulnerabilities, for example mysql_real_escape_string. I found an exploit and the author ...
6 votes
4 answers
6k views

MySQL AES_ENCRYPT key length

AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how MySQL handle longer or shorter keys? I found out that PyCrypto for instances recomend to transform the key by using MD5, SHA-1, SHA-2, ...
  • 419
6 votes
6 answers
15k views

Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL

We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough. We've begun looking into ...
  • 161
5 votes
2 answers
534 views

Identifying an ongoing exploit?

Recently I was contacted by a person saying that they had found a vulnerability in my site. They were able to prove it, by sending me a list of my own databases (some of which had been created but ...
5 votes
1 answer
2k views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here is ...
user avatar
5 votes
3 answers
2k views

The security of the PASSWORD function in MySQL

The PASSWORD function in MySQL can be translated to the code in php: function mysql_password($string){ $pass = strtoupper( sha1( sha1($string, true) ) ...
  • 383
4 votes
3 answers
1k views

Is it secure to centralize database information?

I would know if it is secure to centralize database information into one file like this : db_infos.php: $server = "localhost"; $user = "root"; $password = "1234"; $database = "foo"; $table = "bar"; ...
  • 143
4 votes
1 answer
2k views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
  • 207
4 votes
3 answers
778 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I left ...
user avatar
3 votes
2 answers
4k views

Is PHP OpenSSL safer than just using MySQL AES_ENCRYPT/DECRYPT alone?

I wish to encrypt/decrypt data in my MySQL database stored on my server. I use a salted hash for my passwords. All encryption/decryption would occur on the server. I use PHP end points which my remote ...
user avatar
3 votes
1 answer
2k views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
  • 133
2 votes
1 answer
827 views

Is it safe to leave MySQL root user without a password if it uses auth_socket?

Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password. Is it safe to leave the root user that way (without a password)?
2 votes
2 answers
2k views

Preventing SQL Injections

So I'm pretty new to SQL so I'm not too familiar with how to prevent any SQL injections. I have 1 main form that's being used as a poll and it currently only has 1 text field. At the moment I think I'...
  • 135
2 votes
3 answers
367 views

How to secure MySQL server for the case of hardware theft

I am setting up a new MySQL server in the office. The client app, connecting from the same LAN, is now in beta testing. So I can still change authentication system and other stuff there. Currently I ...
2 votes
2 answers
9k views

How to improve performance of encrypted MySQL database on Linux backend server?

Is ezNcrypt's transparent encryption technology the only way to get a big boost in performance? Are there other good solutions out there we could be looking at for encrypting the entire database with ...
  • 59
2 votes
1 answer
588 views

Someone searching "0x6461726b33636f6465" - what kind of exploit is this?

Recently spotted someone searching: 1 and 1 2 union select 0x6461726b31636f6465-- And a bunch of variations. What type of exploit is this and what does it attempt to do? I don't believe I'm at ...
1 vote
1 answer
1k views

Bypass PHP strtoupper() to perform SQL-injection on MySQL database?

I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case ...
1 vote
1 answer
1k views

Why does error-based SQL injection works only with certan fields?

I'm currently investigating the latest vulnerability affecting Joomla CMS. You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is ...
1 vote
1 answer
5k views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
  • 181
1 vote
2 answers
3k views

SQL Injection not working when I think it should

I am trying to learn about PHP and SQL Injections, so I have created a login form where users introduce their username and password and click the Login button. Later in the server I get the passed ...
  • 75
1 vote
1 answer
633 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
0 votes
1 answer
87 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...