sql-injection | 易学教程

Is this query safe from sql injection?

阅读更多关于 Is this query safe from sql injection?

问题 The script is in PHP and as DB I use MySQL. Here is the script itself. $unsafe_variable = $_GET["user-input"]; $sql=sprintf("INSERT INTO table (column) VALUES('%s')",$unsafe_variable); mysql_query($sql); Some people say that if user assigns ;DROP TABLE blah; string to the variable $unsafe_variable it deletes the table. But I tried this example, http://localhost/test.php?user-input=DROP%20TABLE%20my_table But it didn't delete the table but instead inserted a new row (;DROP TABLE blah;) in the

RegEx to Detect SQL Injection

阅读更多关于 RegEx to Detect SQL Injection

Is there a Regular Expression that can detect SQL in a string? Does anyone have a sample of something that they have used before to share? Don't do it. You're practically guaranteed to fail. Use PreparedStatement (or its equivalent) instead. use stored procs or prepared statements, how will you detect something like this? BTW do NOT run that DECLARE%20@S%20VARCHAR(4000);SET%20@S=CAST(0x4445434C415 245204054205641524348415228323535292C40432056415243 4841522832353529204445434C415245205461626C655 F437572736F7220435552534F5220464F522053454C45435420612E6

Protect against SQL injection

阅读更多关于 Protect against SQL injection

I'm developing a website and I'm trying to secure the connection part. I used the addslashes function on $login to stop SQL injection but some friends told me that's not enough security. However, they didn't show me how to exploit this vulnerability. How can I / could you break this code? How can I secure it? <?php if ( isset($_POST) && (!empty($_POST['login'])) && (!empty($_POST['password'])) ) { extract($_POST); $sql = "SELECT pseudo, sex, city, pwd FROM auth WHERE pseudo = '".addslashes($login)."'"; $req = mysql_query($sql) or die('Erreur SQL'); if (mysql_num_rows($req) > 0) { $data = mysql

What characters or character combinations are invalid when ValidateRequest is set to true?

阅读更多关于 What characters or character combinations are invalid when ValidateRequest is set to true?

问题 I've tried looking at the Microsoft site and Googling this but nobody seems to have an answer aside from the < and the >. There's more to it than that though. I've noticed that the HTML entity starter of &# is invalid. Is there anything else? Does anyone have a complete list? Thanks! 回答1: List of characters by framework version 1.1 Framework Validation: * &# * <alpha, <!, </ * script * On handlers like onmouseenter, etc… * expression( * Looks for these starting characters (‘<’, ‘&’, ‘o’, ‘O’,

Is mysql_real_escape_string enough to Anti SQL Injection?

阅读更多关于 Is mysql_real_escape_string enough to Anti SQL Injection?

In PHP Manual, there is a note: Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks. Is this enough to anti sql injection? If not, could you give an example and a good solution to anti sql injection? mysql_real_escape_string is usually enough to avoid SQL injection. This does depend on it being bug free though, i.e. there's some small unknown chance it is vulnerable (but this hasn't manifested in the real world yet). A better alternative which completely rules out SQL injections on a conceptual level is prepared statements . Both methods entirely

Attempted SQL injection attack - what are they trying to do?

阅读更多关于 Attempted SQL injection attack - what are they trying to do?

问题 I have a public facing website that has been receiving a number of SQL injection attacks over the last few weeks. I exclusively use parameterised stored procedures so I believe that there has been no successful attacks, but a recent log showed an interesting technique: Line breaks added for clarity http://www.mydummysite.uk/mypage.asp?l_surname=Z;DECLARE%20@S%20CHAR(4000);SET @S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263

PHP/SQL Database querying good practice and security

阅读更多关于 PHP/SQL Database querying good practice and security

问题 So I'm a slightly seasoned php developer and have been 'doin the damn thing' since 2007; however, I am still relatively n00bish when it comes to securing my applications. In the way that I don't really know everything I know I could and should. I have picked up Securing PHP Web Applications and am reading my way through it testing things out along the way. I have some questions for the general SO group that relate to database querying (mainly under mysql): When creating apps that put data to

When is it best to sanitize user input?

阅读更多关于 When is it best to sanitize user input?

User equals untrustworthy. Never trust untrustworthy user's input. I get that. However, I am wondering when the best time to sanitize input is. For example, do you blindly store user input and then sanitize it whenever it is accessed/used, or do you sanitize the input immediately and then store this "cleaned" version? Maybe there are also some other approaches I haven't though of in addition to these. I am leaning more towards the first method, because any data that came from user input must still be approached cautiously, where the "cleaned" data might still unknowingly or accidentally be

How does SQL query parameterisation work?

阅读更多关于 How does SQL query parameterisation work?

问题 I feel a little silly for asking this since I seem to be the only person in the world who doesn't get it, but here goes anyway. I'm going to use Python as an example. When I use raw SQL queries (I usually use ORMs) I use parameterisation, like this example using SQLite: Method A: username = "wayne" query_params = (username) cursor.execute("SELECT * FROM mytable WHERE user=?", query_params) I know this works and I know this is the generally recommended way to do it. A SQL injection-vulnerable

Can parameterized statement stop all SQL injection?

阅读更多关于 Can parameterized statement stop all SQL injection?

If yes, why are there still so many successful SQL injections? Just because some developers are too dumb to use parameterized statements? The links that I have posted in my comments to the question explain the problem very well. I've summarised my feelings on why the problem persists, below: Those just starting out may have no awareness of SQL injection. Some are aware of SQL injection, but think that escaping is the (only?) solution. If you do a quick Google search for php mysql query , the first page that appears is the mysql_query page, on which there is an example that shows interpolating