6
There are some details which I would have wanted for a better understanding, but I'm assuming that you are trying to send malicious SQLi in a search parameter.
Let me use an example that you are searching for the term 'shoes'
The web request for that might be: www.example.com/search.php?tag=shoes
The SQL query for that request might use LIKE. I have used ...
5
According to the MySQL documentation, MySQL requires at least one whitespace character after the double dash for it to be registered as a comment.
1
The only currently known SQL injection vulnerability in PDO parameterized prepared statements using the default of emulating prepared statements is if the client's and server's locale is out of sync.
Since locale is negotiated during the initial connection setup, and persists for that connection even if the server's default is changed, in order to get the ...
1
A few things:
Bugs
There are two sources for bugs here: Your role definition, and the database software itself. If you configure the role wrong, or the database software has a bug which allows people to do things they shouldn't, then... well, it depends on the exact bug, of course, but really anything can happen.
"I can constrain the contents of the SQL ...
1
It definitely sounds like you could get clarity on a the task.
But if that's all you have, I would start here: https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet
These are the 10 most common vulnerabilities for web applications. I would suggest going through each one following the instructions for checking whether they exist and steps to remediate ...
Only top voted, non community-wiki answers of a minimum length are eligible
