I'm trying to prevent SQL Injection using PHP with PDO. I've used this as a reference.  . My code doesn't give me any error but the values that are getting in are all null.  The vlaues I'm trying to insert are not null. I know this because I've echo'ed them out:  echo "\nDate: ".$date." Name: ".$name." mail: ".$mail."Comment: ".$comment." website: ".$website;  $sql = "INSERT post SET timeDate = :timeDate and name = :name and mail = :mail and comment = :comment and website = :website"; $stmt = $db-&gt;prepare($sql); $stmt-&gt;bindParam(":timeDate", $date); $stmt-&gt;bindParam(":name", $name); $stmt-&gt;bindParam(":mail", $mail); $stmt-&gt;bindParam(":comment", $comment); $stmt-&gt;bindParam(":website", $website); $stmt-&gt;execute();
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
6325
I had a query (for Postgres and Informix) with a NOT IN clause containing a subquery that in some cases returned NULL values, causing that clause (and the entire query) to fail to return anything.   What's the best way to understand this? I thought of NULL as something without a value, and therefore wasn't expecting the query to fail, but obviously that's not the correct way to think of NULL.
21469
I am studying the new database layer, and I am glad it is changed to an OOP layer. I need to implement a query with db_select(). I found I can add a WHERE statement with $query-&gt;condition(), but by default the conditions are AND'ed together.  How can I OR the conditions together?  $query=db_select('users','u')-&gt;fields('u',array('uid','title','created','uid')); $query-&gt;join('flag_content','fc' , 'u.uid = fc.content_id'); $query-&gt;condition('fc.fid', '5' , '='); $query-&gt;condition('fc.uid', $uid , '='); //…
26106
I have webservice which is passed an array of ints. I'd like to do the select statement as follows but keep getting errors. Do I need to change the array to a string?  [WebMethod] public MiniEvent[] getAdminEvents(int buildingID, DateTime startDate) {         command.CommandText = @"SELECT id,                             startDateTime, endDateTime From                             tb_bookings WHERE buildingID IN                             (@buildingIDs) AND startDateTime &lt;=                             @fromDate";      SqlParameter buildID = new SqlParameter("@buildingIDs", buildingIDs); }
75001
As the topic suggests I wish to be able to pass table names as parameters using .NET (doesn't matter which language really) and SQL Server.  I know how to do this for values, e.g. command.Parameters.AddWithValue("whatever", whatever) using @whatever in the query to denote the parameter. The thing is I am in a situation where I wish to be able to do this with other parts of the query such as column and table names.  This is not an ideal situation but it's one I have to use, it's not really prone to SQL injection as only someone using the code can set these table names and not the end-user. It is messy however.  So, is what I am asking possible?   EDIT: To make the point about SQL injection clear, the table names are only passed in by source code, depending on the situation. It is the developer who specifies this. The developer will have access to the database layer anyway, so the reason I am asking is not so much for security but just to make the code cleaner.
71438
I am always puzzled regarding some mysterious t-sql behavior, like the following  -- Create table t and insert values.   use tempdb CREATE TABLE dbo.t (a INT NULL);   -- insert 3 values INSERT INTO dbo.t values (NULL),(0),(1);   GO   set ansi_nulls off -- purposely turn off, so we can allow NULL comparison, such as null = null go -- expect 3 rows returned but only 2 returned (without null value row) select * from dbo.t where a = a    This is not about how to retrieve all rows in a table and also not about avoiding use of ANSI_NULLS.   I just want to solicit some insights why t-sql behaves like this.
124212
I'm using the MySQL Query Browser (part of the ) and need to change a field to NULL, but I can't figure out how to do it - if I delete the value it tries to update it to ''. Typing "NULL" makes it try to update to 'NULL' (a string).  I know I could just write a query to do it, but that defeats the entire purpose of the tool, no?
78016
For the last couple of days I've been getting the following error:     Fatal error: Undefined class constant 'MYSQL_ATTR_USE_BUFFERED_QUERY' in /home/mydomain/public_html/drupal/includes/database/mysql/database.inc on line 46   This comes after my Hosting did an upgrade and PHP is now version 5.2.17.  From what they have told me, I think I have to enable a PDO MySQL extension in php.ini.  The problem is I'm on a shared hosting and I don't have access to the file; also, my Hosting said they can't change it either.  My info.php shows:     PDO      PDO support enabled      PDO drivers sqlite, sqlite2        pdo_sqlite      PDO Driver for SQLite 3.x enabled      PECL Module version (bundled) 1.0.1 $Id: pdo_sqlite.c 293036 2010-01-03 09:23:27Z   sebastian $      SQLite Library 3.3.7     I tried modifying the .htaccess file and/or adding my own php.ini file to the root directory per some suggestions I found, but nothing I've tried has worked yet.  Can anyone please suggest what else I could do?  EDIT:  Once again I asked the Hosting to enable PDO_MySQL extension and their answer was that they could not, that cPanel (to which they migrated from Plesk, causing this whole problem) had this extension disabled by default and changing it would affect their servers.  Their solution?  That I would change my programming to adjust to these new features, which I wouldn't even know how to go about.  Are they right requesting that I do this? Is there any other way?
44862
I have a problem binding booleans using mysqli_stmt::bind_param in PHP5. The SQL query is the following: insert into `nvp_notes` (subject,messageid,receivedate,read) values (?,?,?,?)  Where 'read' is a tinyint, either 0 or 1, as I've had issues with bit using mysqli. So the types that I list in bind_param are: $stmt-&gt;bind_param('sdsd', ...);  I've also tried 'sdsb' and 'sdss' but nothing seems to work, and I always get the message:  Warning: mysqli_stmt::bind_param(): Number of variables doesn't match number of parameters in prepared statement  When I remove the read field in the statement everything works fine. I've run out of ideas with this one. Surely bind_param works with booleans?
117512
I am trying to run a SQL code (I use MySQL). What I want to do is to set DATE_REACT a value when the first condition is satisfied, and a different value when the first condition is not satisfied. The problem is that the first condition is executed always, even when it shouldn't. What I am doing wrong?  UPDATE BILLS SET STATE = 2, DATE_REACT = CASE  WHEN (DATE_EM &lt;= CURTIME() &lt;= ADDTIME(DATE_EM, '00:02:00')) THEN ADDTIME(CURTIME(), '00:13:00') ELSE ADDTIME(DATE_REACT, '00:13:00') END WHERE STATE = 1;
86789
I don't have this kind of ID in my table, still MySQL is giving me a result.  This same result is giving when i place in my php code.
27997
When a PHP application makes a database connection it of course generally needs to pass a login and password. If I'm using a single, minimum-permission login for my application, then the PHP needs to know that login and password somewhere. What is the best way to secure that password? It seems like just writing it in the PHP code isn't a good idea.
47815
What is a strong way to protect against sql injection for a classic asp app?  FYI I am using it with an access DB.  (I didnt write the app)
60004
Is it possible to convert a timestamp to a date format in a query?  This is the code I am using.  $query = db_select('my_submissions', 's'); $query-&gt;fields('s', array('sid','name','company','email','phone','is_customer','submitted','count')); $entries = $query-&gt;execute();  $rows = array(); foreach ($entries as $entry) {   $row = array_map('check_plain', (array) $entry);   $row['submitted'] = $row['submitted'] ? date('d.m.Y H:i', $row['submitted']) : "";   $rows[] = $row; }
78597
I keep getting the System.NullPointerException: Attempt to de-reference a null object on my trigger at line 21. I've attempted to add != null to that line and I get an error too. Please see the code below.  trigger UpdateDMAAccount on Account (before insert, before update) { //get set of Postal Codes from leads to be inserted or updated Set&lt;String&gt; BillingpostalCodes = new Set&lt;String&gt;(); for(Account l : trigger.new){ if(l.BillingPostalCode != null){     BillingpostalCodes.add(l.BillingPostalCode);  } } if(BillingpostalCodes.size() &gt; 0){ //create Map of custom object records with Name (PostalCode) as key Map&lt;String,DMA_Value__c&gt; validBillingPostalCode = new Map&lt;String,DMA_Value__c&gt;(); for(DMA_Value__c obj : [SELECT Id, Name, DMA_Value__c FROM DMA_Value__c WHERE Name IN :BillingpostalCodes]){     validBillingPostalCode.put(obj.Name,obj); } for(Account l : trigger.new){     if((Trigger.isInsert || trigger.oldMap.get(l.Id).BillingPostalCode != l.BillingPostalCode) &amp;&amp; validBillingPostalCode.containsKey(l.BillingPostalCode)){          l.DMA__c = validBillingPostalCode.get(l.BillingPostalCode).DMA_Value__c;     }     else if(trigger.oldMap.get(l.Id).BillingPostalCode != NULL || l.BillingPostalCode &amp;&amp; !validBillingPostalCode.containsKey(l.BillingPostalCode)){         //blank value if new PostalCode does not match a record in the Map         l.DMA__c = Null;     }   }  } }
30885
In the PHP manual, to show the syntax for functions with optional parameters, they use brackets around each set of dependent optional parameter. For example, for the  function, the manual reads:  string date ( string $format [, int $timestamp = time() ] )   Where $timestamp is an optional parameter, and when left blank it defaults to the  function's return value.  How do you go about creating optional parameters like this when defining a custom function in PHP?
20284
I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on the Internet for the most common SQL injections and try them out on my application?  I hope some guidance would be profitable for other newbies like me, so please, help me complete the following lists:   List of "places" in the application to be tested:   username  password(s)  e-mail search field  text fields any other fields that are available to the user  List of tests to be performed:   ...?    Thanks!