sql-injection | 易学教程

Is this query safe from sql injection?

阅读更多关于 Is this query safe from sql injection?

The script is in PHP and as DB I use MySQL. Here is the script itself. $unsafe_variable = $_GET["user-input"]; $sql=sprintf("INSERT INTO table (column) VALUES('%s')",$unsafe_variable); mysql_query($sql); Some people say that if user assigns ;DROP TABLE blah; string to the variable $unsafe_variable it deletes the table. But I tried this example, http://localhost/test.php?user-input=DROP%20TABLE%20my_table But it didn't delete the table but instead inserted a new row (;DROP TABLE blah;) in the table. Could anybody explain me how it is possible to attack this script with sql injections? That

Escaping user input from database necessary?

阅读更多关于 Escaping user input from database necessary?

问题 So I know about MySQL injection and always escape all my user input before putting it in my database. However I was wondering, imagine a user tries to submit a query to inject, and I escape it. What if I then at a later moment take this value from the database, and use it in a query. Do I have to escape it again? So: ( sql::escape() contains my escape function) $userinput = "'); DROP `table` --"; mysql_query("INSERT INTO `table` (`foo`,`bar`) VALUES ('foobar','".sql::escape($userinput)."')");

PostgreSQL - DB user should only be allowed to call functions

阅读更多关于 PostgreSQL - DB user should only be allowed to call functions

问题 Currently I'm using PostgreSQL for my application. Since I am trying to put every SQL that contains a transaction (i.e. insert, update, delete) in a function, I stumbled upon this problem: Is it possible that a database user may only be allowed to call functions and Select-Statements while he can not call SQL-Statements which contains a transaction? By "call functions" I mean any function. Regardless if it contains a transaction or not. I already tried to create a user which can only call

Which characters are actually capable of causing SQL injection in mysql

阅读更多关于 Which characters are actually capable of causing SQL injection in mysql

问题 We all know that we should use prepared statements or the appropriate replacement/formatting rules in order to prevent sql injection in our applications. However, when taking a look at MySQL's list of character literals, I noticed that it includes the following characters: \0 An ASCII NUL ( 0x00 ) character. \' A single quote ( ' ) character. \" A double quote ( " ) character. \b A backspace character. \n A newline (linefeed) character. \r A carriage return character. \t A tab character. \Z

function to sanitize input to Mysql database

阅读更多关于 function to sanitize input to Mysql database

问题 I am trying to put a general purpose function together that will sanitize input to a Mysql database. So far this is what I have: function sanitize($input){ if(get_magic_quotes_qpc($input)){ $input = trim($input); // get rid of white space left and right $input = htmlentities($input); // convert symbols to html entities return $input; } else { $input = htmlentities($input); // convert symbols to html entities $input = addslashes($input); // server doesn't add slashes, so we will add them to

How can I prevent SQL injection attacks in Go while using “database/sql”?

阅读更多关于 How can I prevent SQL injection attacks in Go while using “database/sql”?

问题 Building my first web-app and want to understand SQL injection better (https://github.com/astaxie/build-web-application-with-golang/blob/master/en/eBook/09.4.md). How much protection against SQL injection do I get from just always using the 'database/sql' library and constructing queries using '?' instead of concatting strings? What kind of SQL injection attacks will I still have to worry about in that case? 回答1: As long as you're using Prepare or Query, you're safe. // this is safe db.Query(

A PHP function to prevent SQL Injections and XSS

阅读更多关于 A PHP function to prevent SQL Injections and XSS

I am tring to make my PHP as secure as possible, and the two main things I am trying to avoid are mySQL Injections Cross-Side Scripting (XSS) This is the script I got against mySQL Injections: function make_safe($variable) { $variable = mysql_real_escape_string(trim($variable)); return $variable; } http://www.addedbytes.com/writing-secure-php/writing-secure-php-1/ Against XSS, I found this: $username = strip_tags($_POST['username']); Now I want to unite the two into a single function. Would this be the best way to do so? : function make_safe($variable) { $variable = strip_tags(mysql_real

PHP/SQL Database querying good practice and security

阅读更多关于 PHP/SQL Database querying good practice and security

So I'm a slightly seasoned php developer and have been 'doin the damn thing' since 2007; however, I am still relatively n00bish when it comes to securing my applications. In the way that I don't really know everything I know I could and should. I have picked up Securing PHP Web Applications and am reading my way through it testing things out along the way. I have some questions for the general SO group that relate to database querying (mainly under mysql): When creating apps that put data to a database is mysql_real_escape_string and general checking (is_numeric etc) on input data enough? What

How does SQL query parameterisation work?

阅读更多关于 How does SQL query parameterisation work?

I feel a little silly for asking this since I seem to be the only person in the world who doesn't get it, but here goes anyway. I'm going to use Python as an example. When I use raw SQL queries (I usually use ORMs) I use parameterisation, like this example using SQLite: Method A: username = "wayne" query_params = (username) cursor.execute("SELECT * FROM mytable WHERE user=?", query_params) I know this works and I know this is the generally recommended way to do it. A SQL injection-vulnerable way to do the same thing would be something like this: Method B: username = "wayne" cursor.execute(

Are SQL injection attacks possible in JPA?

阅读更多关于 Are SQL injection attacks possible in JPA?

I'm building a Java Web Application using Java EE 6 and JSF-2.0, using the persistence API for all database operations. The back-end is MySQL, but I have used the EntityManager functions and Named Queries in EJB-QL for all operations. Are SQL injection attacks possible in this case? It's only possible if you're inlining user-controlled variables in a SQL/JPQL string like so: String sql = "SELECT u FROM User u WHERE id=" + id; If you aren't doing that and are using parameterized/named queries only, then you're safe. Jigar Joshi Yes, it is possible. It depends on the way you implement. Have a