sql-injection

问题 DBMS_ASSERT is one of the keys to prevent SQL injection attacks in Oracle. I tried a cursory search...is there any SQL Server 2005/2008 equivalent for this functionality? I am looking for a specific implementation that has a counterpart of all the respective Oracle package members of DBMS_ASSERT. NOOP SIMPLE_SQL_NAME QUALIFIED_SQL_NAME SCHEMA_NAME I know the best-practices of preventing injection...bind variables...being one of them. But,in this question I am specifically looking for a good

问题 I have a problem wich is a little strange. My page contains a html link which refreshes the page and calls a PHP variable. This variable appends a date string to the url string which is fed into a MySQL query, which grabs records matching this date. I think this is causing an injection as it sometimes deletes the user from the database! I know there may be security issues using the '#' in the hyperlink, but I'd like to know whats going on. Also would this have different effects on different

问题 In accessing my database, I have the user fill out a form, and in the target page, the posted values are used in the resulting MySQL query. $query = mysql_query("SELECT pass FROM database WHERE user='$_POST[user]'"); However, for some reason or another, MySQL doesn't like my using a $_POST variable in the command, and it only works if I define (for example) $user = $_POST['user']; , and then put $user directly in the SQL command. On the other hand, I can use $_POST values in INSERT statements

问题 What does mysql_real_escape_string() do with the % (percent) character and how much of a security risk does it represent (and how to fix it)? 回答1: From the mysql_real_escape_string() documentation: Note: mysql_real_escape_string() does not escape % and _. These are wildcards in MySQL if combined with LIKE, GRANT, or REVOKE. As far as security, unless you are running a LIKE , GRANT , or REVOKE , it's a non-issue. LIKE is probably the only real concern. It's up to you how you would want to

问题 Since so many other websites have been hit I have to assume it is a bot! It has injected a script with: Yesterday: http://google-stats50.info/ur.php Today: http://google-stats49.info/ur.php It injected it into multiple tables. First, how did it identify the tables and columns? Second, what should I search for in the logs to identify the source page? We do not have ftp on any of our servers. We have 1 contact form but it is email and not even connected to the database. We are using SQL Server

问题 include "../admin/site.php"; // Setup db connection. $appid = -1; if (is_string($_GET["id"])) { $id = mysql_real_escape_string($_GET["id"]); $sql = "select * from version where id=$id"; $ver = mysql_query($sql); if ($id > 0 && $ver && mysql_num_rows($ver)) { $appid = mysql_result($ver, 0, "AppID"); $app = DLookUp("apps", "name", "id=$appid"); $name = mysql_result($ver, 0, "Name"); $notes = mysql_result($ver, 0, "Notes"); } else $app = "No version by that ID"; } else $app = "No ID"; /* some

问题 How can I prevent sql injection when programming against OrientDb using the OrientDB-NET.binary? Is there a way to escape special characters for Orient-SQL and work with string literals? Example: I want to store this literal: me' or 1 = 1 ),'// and then be able to query it like select from MyVertex where text = '...' I'm having trouble doing this in OrientDb studio too. I have found this post which is related to the Java driver, so I was wondering if there is something similar for .NET. 回答1:

问题 I want to avoid SQL Injections in my Webapp. It's Java based. Are PreparedStatements enough? Do i have to filter out the ' and "? Are there already solutions for this in Java? 回答1: My gut response to the question in your second paragraph is that it's usually a bad idea to consider a single aspect "enough" for this sort of issue - at least if you do this to the point that you stop thinking about the principles involved. Using PreparedStatements does go a long way to stopping SQL injection,

问题 I've read about SQL injection so I tried it with my site and of course it worked.. I know that the solution is parameterized queries and I also know that there are a lot of examples out there but none of them mentions the part where we're connecting to the database. So here's a part of my login page's PHP code: $userName = $_POST["username"]; $userPass = $_POST["password"]; $query = "SELECT * FROM users WHERE username = '$userName' AND password = '$userPass'"; $result = mysqli_query($dbc,

问题 This question already has answers here : Closed 7 years ago . Possible Duplicate: Best way to prevent SQL injection in PHP? Ive been doing a bit of testing to protect my sites from SQL Injection. I see there are a couple of ways of doing so, Escaping my user inputs, adding slashes, or better yet using parameterized sql statements. I had this test code.. $q=$_GET["q"]; $game = mysql_query("SELECT * FROM `Games` WHERE `id` = '$q'"); $game = mysql_fetch_array($game); echo "<h4>ID: ".$game[0]."