478 votes

SQL injection is 17 years old. Why is it still around?

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one ...
user avatar
324 votes
Accepted

Is single quote filtering nonsense?

You should implement input validation as a defense-in-depth method. So input validation should not be your primary defense against SQL injection, that should be prepared statements. As an additional ...
user avatar
  • 28.6k
283 votes

SQL injection is 17 years old. Why is it still around?

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the ...
user avatar
178 votes
Accepted

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

Here's an idea for an analogy that I think is fairly accurate while generally understandable: A bank requires two forms of ID to get a loan: a driver's license and a birth certificate. Bank ...
user avatar
173 votes
Accepted

Is it possible to detect 100% of SQLi with a simple regex?

Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it. Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...
user avatar
  • 123k
120 votes

SQL injection is 17 years old. Why is it still around?

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax ...
user avatar
119 votes

Would removing spaces in a string protect against SQL injection?

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
user avatar
  • 5,700
114 votes
Accepted

Does read-only access to the database prevent sql injection?

No. You might be confusing SQL injection with data injection; read-only tables do not prevent SQL injection and at best do only a little to limit its impact. SQL injection simply means the ability ...
user avatar
  • 71.8k
109 votes

Is it possible to detect 100% of SQLi with a simple regex?

NO Since every SQL injection is (by definition) valid SQL and since SQL is a context-free language (source), there is (again, by definition) no regex capable of matching an SQL injection, and trying ...
user avatar
  • 1,734
90 votes

Is there a field length that is too short to allow harmful SQL injection?

Without context, I'm going to presume that the author is referring to input fields in a client application. The easiest example to use would be a form in an HTML page in a web application, though what ...
user avatar
  • 35.5k
90 votes
Accepted

In SQL injections why do they put "-- -" at the end of the URL?

The last dash basically protects the trailing space. If you exploit SQL injection in a browser (e.g. via the URL), some browsers remove trailing space characters. Some prominent SQL flavors explicitly ...
user avatar
  • 7,214
86 votes
Accepted

Is there a field length that is too short to allow harmful SQL injection?

No, there is no length that is too short to be exploitable (at least in some situations). A length-filter is not a valid protection against SQL injection, and prepared statements really are the only ...
user avatar
  • 29k
82 votes

Is this a SQL injection attack or is it some sort of bug?

This is the result of someone trying to exploit an SQL injection on your site. Someone tried to detect if your website was vulnerable to a union-based injection. For all the records that you see, it ...
user avatar
  • 3,623
80 votes
Accepted

How to limit the impact of and reduce the risk of SQL injection for existing website?

Don't spend lots of time on workarounds or half fixes. Every minute you spend trying to implement anything suggested here is a minute you could have spent implementing prepared statements. That is the ...
user avatar
  • 64.2k
75 votes
Accepted

Is SQL injection possible with LIMIT?

You can make a UNION SELECT here. The only problem is to match the columns from messages, but you can guess those by adding columns until it fits: SELECT * FROM messages WHERE unread = 1 LIMIT 1 ...
user avatar
  • 5,404
67 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
user avatar
65 votes

How to limit the impact of and reduce the risk of SQL injection for existing website?

The only correct way is to use prepared statements. If you disguise error messages, it a bit harder, but won't stop attackers. You can restrict the rights, but all rights granted to the user could ...
user avatar
  • 824
62 votes

Is this an attempted SQL injection?

This is most likely a blind SQL injection, testing whether you're vulnerable to SQL Injection by checking whether your server takes the specified time or more to reply to the request. This is not ...
user avatar
  • 1,941
61 votes

SQL injection is 17 years old. Why is it still around?

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe"....
user avatar
  • 1,197
59 votes
Accepted

Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?

From the documentation: From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control ...
user avatar
59 votes

Is it possible to detect 100% of SQLi with a simple regex?

Technically, this is completely possible (though doing so also renders the database useless): .+ Will indeed detect any possible SQLi. However, it will also detect any attempt to do normal queries(...
user avatar
  • 907
57 votes
Accepted

No -*|%/ and no whitespace, is this SQL injectable?

Does this mean my SQL query is safe? Is there any way someone can break my query and view all the records? No, it is not safe. More than being able to view all the records of one table, you can pass ...
user avatar
  • 646
48 votes

Would removing spaces in a string protect against SQL injection?

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
user avatar
47 votes
Accepted

Is this safe to display MySQL query error in webpage if something went wrong?

End users should never get to see the gory details of your environment. Instead it is more professional to show a generic 'Sorry something went wrong' page. At least visitors can see that you have a ...
user avatar
  • 6,517
46 votes

What pages are vulnerable to SQL injection?

Do you trust all of your authenticated users completely? Including that they won't have their accounts compromised by attackers? It's bad if an attacker gets access to an account, but far worse if ...
user avatar
  • 27.2k
42 votes
Accepted

Is this a SQL injection attack or is it some sort of bug?

Have a look at "Union Injection" SQL attacks such as found here. Basically, it's trying various methods to identify the number of columns in the query, looking for one which is successful. The order ...
user avatar
  • 27.2k
39 votes
Accepted

How to defeat doubling up apostrophes to create SQLi attack?

I try to show both sides of the security spectrum. Security is important, so you shouldn't just know how to defeat security, you should know how to implement it as well. Thus, I'm going to list a ...
user avatar
  • 22.5k
39 votes
Accepted

Second order SQL injection protection

A second order SQL injection is an injection where the payload is already stored in the database (instead of say being delivered in a GET parameter). In that sense it is somewhat similar to stored XSS ...
user avatar
  • 64.2k
39 votes
Accepted

SQL injection inside XSS

That depends on what you mean by "inside". For example, as Conor Mancone suggested, there could be a combined reflected XSS and SQL injection. That could look like this: http://example.com/...
user avatar
  • 2,422
38 votes

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

The situation is: people working independently without coordination, to design functionality meant to be useful locally, but when combined, created a disaster. The first historical references that ...
user avatar
  • 123k

Only top scored, non community-wiki answers of a minimum length are eligible