sql-injection | 易学教程

emulated prepared statements vs real prepared statements

阅读更多关于 emulated prepared statements vs real prepared statements

问题 What's exactly the difference between the two kinds of prepared statements ? I think real prepared statements require server side support wich accepts paramenters after parsing and compiling the schema/template of sql code, and , I suppose ,that's what guarantees us against sql-injection. In the case of emulated prepared statements ,with no server support, what does it guarantee us against it ? 回答1: You are correct, real prepared statements must be supported by the server. A real prepared

How can sanitation that escapes single quotes be defeated by SQL injection in SQL Server?

阅读更多关于 How can sanitation that escapes single quotes be defeated by SQL injection in SQL Server?

To start this off, I am well aware that parameterized queries are the best option, but I am asking what makes the strategy I present below vulnerable. People insist the below solution doesn't work, so I am look for an example of why it wouldn't. If dynamic SQL is built in code using the following escaping before being sent to a SQL Server, what kind of injection can defeat this? string userInput= "N'" + userInput.Replace("'", "''") + "'" A similar question was answered here , but I don't believe any of the answers are applicable here. Escaping the single quote with a "\" isn't possible in SQL

How to quote values for LuaSQL?

阅读更多关于 How to quote values for LuaSQL?

问题 LuaSQL, which seems to be the canonical library for most SQL database systems in Lua, doesn't seem to have any facilities for quoting/escaping values in queries. I'm writing an application that uses SQLite as a backend, and I'd love to use an interface like the one specified by Python's DB-API: c.execute('select * from stocks where symbol=?', t) but I'd even settle for something even dumber, like: conn:execute("select * from stocks where symbol=" + luasql.sqlite.quote(t)) Are there any other

Dynamically created SQL vs Parameters in SQL Server

阅读更多关于 Dynamically created SQL vs Parameters in SQL Server

问题 If I were to select a row from a table I basically have two options, either like this int key = some_number_derived_from_a_dropdown_or_whatever SqlCommand cmd = new SqlCommand("select * from table where primary_key = " + key.ToString()); or use a parameter SqlCommand cmd = new SqlCommand("select * from table where primary_key = @pk"); SqlParameter param = new SqlParameter(); param.ParameterName = "@pk"; param.Value = some_number_derived_from_a_dropdown_or_whatever; cmd.Parameters.Add(param);

how to avoid sql injection in codeigniter

阅读更多关于 how to avoid sql injection in codeigniter

In CodeIgniter, how can I avoid sql injection? Is there any method to set in config file to avoid sql injection? I am using this code for selecting values: $this->db->query("SELECT * FROM tablename WHERE var='$val1'"); and this for inserting values: $this->db->query("INSERT INTO tablename (`var1`,`var2`) VALUES ('$val1','$val2')"); Another method used to insert and select values from the database is CodeIgniter's insert() and get() methods. Is any chance to sql injection while using CodeIgniter's bulit-in functions Rocket Hazmat CodeIgniter's Active Record methods automatically escape queries

How can I make a prepared statement in classic asp that prevents sql injection?

阅读更多关于 How can I make a prepared statement in classic asp that prevents sql injection?

问题 I have this which works: sqlString = "SELECT * FROM employees WHERE lastname = '" & last_name & "'" Set cmd = Server.CreateObject("ADODB.Command") Set cmd.ActiveConnection = dbConn cmd.CommandText = sqlString cmd.Prepared = True Set recs = cmd.Execute The problem I have is that above the dynamic part of sqlString is before the prepared statement command. I don't think what I have above is protecting me. Don't I have to fix this sqlString before I do the prepared statement? Reading this made

mysqli prepared statements and mysqli_real_escape_string

阅读更多关于 mysqli prepared statements and mysqli_real_escape_string

问题 I'm currently using the mysqli php extension. Traditionally I have used mysqli_real_escape_string to escape user input. However I am looking at changing over the code (hopefully in as few steps as possible) to use prepared statements. I want to be clear on this - provided I use prepared statements to bind all of my variables, can I be confident that sql injection is impossible? (And dispense completely with mysqli_real_escape_string?) Thanks 回答1: If you correctly bind all your variables you

SQL Injection after removing all single-quotes and dash-characters

阅读更多关于 SQL Injection after removing all single-quotes and dash-characters

问题 Can anyone show an EXAMPLE of a sql statement when SQL Injection occurred even after all "single-quote" and "dash characters" have been stripped out of the user's input? SELECT MyRecord FROM MyTable WHERE MyEmail='susan@site.com' AND MyPassword='foo' (No INTs are involved here.) Everyone seems to say "yes, I can do it"... but when they are pressed for an e-x-a-m-p-l-e... none of ever shown. (You can use any version, new or old, of any sql engine: SQL Server, MySql, SqlLite, PostgreSQL, Oracle

Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?

阅读更多关于 Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?

This is my code: $email= mysqli_real_escape_string($db_con,$_POST['email']); $psw= mysqli_real_escape_string($db_con,$_POST['psw']); $query = "INSERT INTO `users` (`email`,`psw`) VALUES ('".$email."','".$psw."')"; Could someone tell me if it is secure or if it is vulnerable to the SQL Injection attack or other SQL attacks ? Scott Arciszewski Could someone tell me if it is secure or if it is vulnerable to the SQL Injection attack or other SQL attacks ? As uri2x says, see SQL injection that gets around mysql_real_escape_string() . The best way to prevent SQL injection is to use prepared

Site has been hacked via SQL Injection

阅读更多关于 Site has been hacked via SQL Injection

问题 Recently my site was hacked via SQL injection. The hacker used the following query to get my DB name. I cannot understand this query they wrote. Query: =-999.9%20UNION%20ALL%20SELECT%20concat(0x7e,0x27,Hex(cast(database()%20as%20char)),0x27,0x7e),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536-- After the query was ran it showed an integer result, something like " 74545883 ". Can you explain how the query works? 回答1: It looks like an overflow attack. They UNION -ed with