478
votes
SQL injection is 17 years old. Why is it still around?
There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one ...
- 181k
324
votes
Accepted
Is single quote filtering nonsense?
You should implement input validation as a defense-in-depth method. So input validation should not be your primary defense against SQL injection, that should be prepared statements. As an additional ...
- 28.6k
283
votes
SQL injection is 17 years old. Why is it still around?
Because it's not a problem.
When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the ...
- 2,737
178
votes
Accepted
Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app
Here's an idea for an analogy that I think is fairly accurate while generally understandable:
A bank requires two forms of ID to get a loan: a driver's license and a birth certificate. Bank ...
- 1,046
173
votes
Accepted
Is it possible to detect 100% of SQLi with a simple regex?
Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it.
Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...
- 123k
120
votes
SQL injection is 17 years old. Why is it still around?
SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax ...
- 10.1k
119
votes
Would removing spaces in a string protect against SQL injection?
No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
- 5,700
114
votes
Accepted
Does read-only access to the database prevent sql injection?
No. You might be confusing SQL injection with data injection; read-only tables do not prevent SQL injection and at best do only a little to limit its impact.
SQL injection simply means the ability ...
- 71.8k
109
votes
Is it possible to detect 100% of SQLi with a simple regex?
NO
Since every SQL injection is (by definition) valid SQL and since SQL is a context-free language (source), there is (again, by definition) no regex capable of matching an SQL injection, and trying ...
- 1,734
90
votes
Is there a field length that is too short to allow harmful SQL injection?
Without context, I'm going to presume that the author is referring to input fields in a client application. The easiest example to use would be a form in an HTML page in a web application, though what ...
- 35.5k
90
votes
Accepted
In SQL injections why do they put "-- -" at the end of the URL?
The last dash basically protects the trailing space. If you exploit SQL injection in a browser (e.g. via the URL), some browsers remove trailing space characters. Some prominent SQL flavors explicitly ...
- 7,214
86
votes
Accepted
Is there a field length that is too short to allow harmful SQL injection?
No, there is no length that is too short to be exploitable (at least in some situations).
A length-filter is not a valid protection against SQL injection, and prepared statements really are the only ...
- 29k
82
votes
Is this a SQL injection attack or is it some sort of bug?
This is the result of someone trying to exploit an SQL injection on your site. Someone tried to detect if your website was vulnerable to a union-based injection. For all the records that you see, it ...
- 3,623
80
votes
Accepted
How to limit the impact of and reduce the risk of SQL injection for existing website?
Don't spend lots of time on workarounds or half fixes. Every minute you spend trying to implement anything suggested here is a minute you could have spent implementing prepared statements. That is the ...
- 64.2k
75
votes
Accepted
Is SQL injection possible with LIMIT?
You can make a UNION SELECT here. The only problem is to match the columns from messages, but you can guess those by adding columns until it fits:
SELECT * FROM messages WHERE unread = 1 LIMIT
1 ...
- 5,404
67
votes
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function
The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
- 12.2k
65
votes
How to limit the impact of and reduce the risk of SQL injection for existing website?
The only correct way is to use prepared statements.
If you disguise error messages, it a bit harder, but won't stop attackers.
You can restrict the rights, but all rights granted to the user could ...
- 824
62
votes
Is this an attempted SQL injection?
This is most likely a blind SQL injection, testing whether you're vulnerable to SQL Injection by checking whether your server takes the specified time or more to reply to the request. This is not ...
- 1,941
61
votes
SQL injection is 17 years old. Why is it still around?
When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe"....
- 1,197
59
votes
Accepted
Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?
From the documentation:
From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control ...
- 15.4k
59
votes
Is it possible to detect 100% of SQLi with a simple regex?
Technically, this is completely possible (though doing so also renders the database useless):
.+ Will indeed detect any possible SQLi.
However, it will also detect any attempt to do normal queries(...
- 907
57
votes
Accepted
No -*|%/ and no whitespace, is this SQL injectable?
Does this mean my SQL query is safe? Is there any way someone can break my query and view all the records?
No, it is not safe. More than being able to view all the records of one table, you can pass ...
- 646
48
votes
Would removing spaces in a string protect against SQL injection?
We're in 2016! SQL injections are a thing of the past unless you use insecure code.
Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
- 1,919
47
votes
Accepted
Is this safe to display MySQL query error in webpage if something went wrong?
End users should never get to see the gory details of your environment.
Instead it is more professional to show a generic 'Sorry something went wrong' page. At least visitors can see that you have a ...
- 6,517
46
votes
What pages are vulnerable to SQL injection?
Do you trust all of your authenticated users completely? Including that they won't have their accounts compromised by attackers? It's bad if an attacker gets access to an account, but far worse if ...
- 27.2k
42
votes
Accepted
Is this a SQL injection attack or is it some sort of bug?
Have a look at "Union Injection" SQL attacks such as found here.
Basically, it's trying various methods to identify the number of columns in the query, looking for one which is successful. The order ...
- 27.2k
39
votes
Accepted
How to defeat doubling up apostrophes to create SQLi attack?
I try to show both sides of the security spectrum. Security is important, so you shouldn't just know how to defeat security, you should know how to implement it as well. Thus, I'm going to list a ...
- 22.5k
39
votes
Accepted
Second order SQL injection protection
A second order SQL injection is an injection where the payload is already stored in the database (instead of say being delivered in a GET parameter). In that sense it is somewhat similar to stored XSS ...
- 64.2k
39
votes
Accepted
SQL injection inside XSS
That depends on what you mean by "inside". For example, as Conor Mancone suggested, there could be a combined reflected XSS and SQL injection. That could look like this:
http://example.com/...
- 2,422
38
votes
Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app
The situation is: people working independently without coordination, to design functionality meant to be useful locally, but when combined, created a disaster.
The first historical references that ...
- 123k
Only top scored, non community-wiki answers of a minimum length are eligible