im bulding a student management system using php and codeigniter. After running a webapp vulnerability scanner i got a critical error on 'stid' paremiter is vulnerable to blind sql injection. This paremiter is used when a student create account, so the sytem take this student id and pass it to the database to see if its alreday exist or not. To make sure it's not false alarm i also uses sqlmap and also it detect this blind sql injection and dump out my databases. Here below is the place where i belive there is a problem. I'll appreciate any suggetion to mitigate this problem. Thanks function student_status(){    $input = $this-&gt;input-&gt;post();     $message = array();     switch($input['content']) {         case 'studentid':             $user = new User();             $user-&gt;where(&quot;registration_number_id&quot;,$input['stid'])-&gt;get();             if($user-&gt;result_count()){                 $message['error'] = true;                 $message['message'] = 'User Already has an account';             }else{                 $student = new StudentInfo();                 $student-&gt;where('registration_number',$input['stid'])-&gt;get();                 $this-&gt;commondata = $student-&gt;get_basic_info($input['stid']);
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
120775
I have the following code and while get_the_ID() works, $post->ID does not, why?      $the_query = new WP_Query( array(         'post_type' =&gt; 'custompost',     ) );      while ( $the_query-&gt;have_posts() ) : $the_query-&gt;the_post();         echo $post-&gt;ID;     endwhile;
55284
When I run the following query in query editor I get this error.  Error     Unknown error parsing query   Query  SELECT Id, OwnerId,Account.OwnerId FROM Contact where OwnerId = Account.OwnerId limit 100   Does anybody know what the problem is?
4667
Getting error with this code but I can't figure it out  trigger LeadConvert on Lead (after insert) {     list leadsToConvert = new list();      Database.LeadConvert lc;     string convertedStatus = '';     list convertStatusList = new list();     convertStatusList = [Select Id, MasterLabel                          from LeadStatus where IsConverted=true limit 1];     if(convertStatusList.size() &gt; 0){         convertedStatus = convertStatusList[0].MasterLabel;         }     else{              convertedStatus = 'Closed - Converted';          }      for(Lead l : trigger.New){         if(l.AutoConvert__c == true){             lc = new database.LeadConvert();             lc.setLeadId(l.ID);             lc.setDoNotCreateOpportunity(true);              lc.setConvertedStatus(convertedStatus);             leadsToConvert.add(lc);         }     }      list lcrList = new list();     lcrList = Database.convertLead(leadsToConvert); }
20384
With the following code, if the current user does not have 'bypass node access' (see  for exact verifications), then the query checks for node_access, even though I do not use the "node_access" tag.  How can I avoid the node_access check with the following query for a non-admin user?   I'm using this code from a module, so I can verify permissions myself, no need for node_access checks.    $query = new EntityFieldQuery;   $result = $query     -&gt;entityCondition('entity_type', 'node')     -&gt;entityCondition('bundle', 'foo')     -&gt;fieldCondition('custom_id', 'value', $custom_id)     -&gt;execute();
34791
This is the announcement post of the Stack Exchange Data Explorer. Its answers were meant to iron out the initial glitches 6 to 8 years ago.  If you have found a bug or need support  today with any of SEDEs features, please ask a new question and tag it with   What does it do? Allows you to run arbitrary SQL queries on the data dumps, and share those queries with your friends. Technical details It is hosted on the Stack Exchange infrastructure , the database is hosted on the same SQL Server version all other sites are hosted on. You can use most of the TSQL commands, even create temporary objects (but not User Defined Functions). The controls used are jQuery based, the grid is  . All query results are cached, so sharing a link to a query will not result in the server going in to a tailspin. The query edit control is a slightly modified  control, I also am considering bespin cause the inter iframe communication is nasty complicated. It gives up nice syntax highlighting for queries. Parameters There is support for parameterized queries, to get it to work name your params like ##this##. For example have a . Query name and description A query can have a name and description, to name it lead with a comment, to describe it continue commenting, for example: -- This is my query name  -- This is my description -- I can span multiple lines  SELECT 1  Anonymous users can initially name a query, but can not change the names of any existing queries. Tutorial There's a  which helps you getting started in writing your own SQL queries. Logging in You can use your openid provider to log in, at the moment once logged in we will track the list of queries you execute (giving you basic history support) Also if there are any params named UserId they will be populated automatically if your EmailHash matches the one on the site being queried. Magic columns If you alias an id column with as [Post Link] it will automatically create a link in the result set to the parent site. Similarly if you alias an id column with as [User Link] it will display a link to the user page. select top 10 * from Posts will show you how tags are done. (Magic columns for images is planned) example (most controversial posts:  ) So what are you waiting for, check it out at  Any feedback would be greatly appreciated. I hope to have the login section working fairly soon and allow voting on the best queries and commenting. Featured Queries At the moment, admins have permission to feature interesting queries on this page , I am looking for better ways to manage the huge query list that is building up.
21469
I am studying the new database layer, and I am glad it is changed to an OOP layer. I need to implement a query with db_select(). I found I can add a WHERE statement with $query-&gt;condition(), but by default the conditions are AND'ed together.  How can I OR the conditions together?  $query=db_select('users','u')-&gt;fields('u',array('uid','title','created','uid')); $query-&gt;join('flag_content','fc' , 'u.uid = fc.content_id'); $query-&gt;condition('fc.fid', '5' , '='); $query-&gt;condition('fc.uid', $uid , '='); //…
30023
Why would someone use WHERE 1=1 AND &lt;conditions&gt; in a SQL clause (Either SQL obtained through concatenated strings, either view definition)  I've seen somewhere that this would be used to protect against SQL Injection, but it seems very weird.  If there is injection WHERE 1 = 1 AND injected OR 1=1 would have the same result as injected OR 1=1.  Later edit: What about the usage in a view definition?    Thank you for your answers.  Still, I don't understand why would someone use this construction for defining a view, or use it inside a stored procedure.  Take this for example:  CREATE VIEW vTest AS SELECT FROM Table WHERE 1=1 AND table.Field=Value
58273
I know that php has md5(), sha1(), and the hash() functions, but I want to create a hash using the MySQL PASSWORD() function.  So far, the only way I can think of is to just query the server, but I want a function (preferably in php or Perl) that will do the same thing without querying MySQL at all.  For example:  MySQL hash -> 464bb2cb3cf18b66  MySQL5 hash -> *01D01F5CA7CA8BA771E03F4AC55EC73C11EFA229  Thanks!
109076
I've been getting some bots trying to get hold of my database by mass attacking /sertup/scripts.php of various database program. I wanna ban such activities.  The closest I found was this:   What is the best way, or is there any scripts to ban bots from attacking?  Thanks.
110884
I have a MySQL Community database on a remote server and I am trying to get Microsoft Access to read data from it. This data is sensitive. The problem is, MySQL doesn't care about the username that I give it in the .DSN file. It lets me read the ENTIRE database no matter what! How do I get it to actually check the username that I give it in the .DSN file?  edit: I'm not a DBA, I'm some intern who is over his head. Please don't assume that I know anything about anything  :)
77056
I have configured my MySQL Database to require passwords on all users, even root from the machine itself.  Now I discovered that there are empty Users in my Database  Reproduce: mysql -u root -p and then use mysql; &amp; select * from user;  It gives me 2 entries, one with "localhost" and user &lt;empty&gt; and one with the machine's hostname and &lt;empty&gt;.  Now I tried to access the account with mysql -u ' ' (yes it's correct, leave a space between the ' things) and I log in without a password. The user can "only" see information_schema and test, the two databases created by default. He does not has access to mysql or any other custom created databases.  I already changed the Password of this user to something I won't tell you  mysql -u root -p use mysql; UPDATE mysql.user SET Password=PASSWORD('thisisasecretpassword') WHERE USER='root'; FLUSH PRIVILEGES;   Now my Questions:   Is any MySQL Server vulnerable for an attack with this entry? Could an attacker break out of this account or the two default databases? Should I password-protect those Users or can I delete them? Are They required for some MySQL-internal things?
99589
I am stuck on the prevent SOQL injection trailhead, where I am looking to determine which portions of the code I would need to invoke escapeSingleQuotes or whitelist to enable. I've made several attempts at investigation to little avail. I have appended my code are there any steps I would need to take. My goal is to assess the code to see how it works and what I would need to do.  public class Prevent_SOQL_Injection_Challenge {  public string textOne {get; set;} public string textTwo {get; set;} public string comparator {get; set;} public string numberOne {get; set;}  public List&lt;Supply__c&gt; whereclause_records {get; set;}   public PageReference stringSearchOne(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(textOne != null &amp;&amp; textOne!=''){             whereClause += 'name like  \'%'+string.escapeSingleQuotes(textOne)+'%\' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+whereClause+' Limit 10');     }      return null; }   public PageReference stringSearchTwo(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(textTwo != null &amp;&amp; textTwo!=''){             whereClause += 'Storage_Location__r.name like  \'%'+string.escapeSingleQuotes(textTwo)+'%\' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+whereClause+' Limit 10');     }      return null; }   public PageReference numberSearchOne(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(numberOne != null &amp;&amp; comparator != null){         whereClause += 'Quantity__c '+comparator+' '+string.ValueOf(numberOne)+' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+string.ValueOf(whereClause)+' Limit 10');     }      return null; } }
3752
I have PHP configured so that magic quotes are on and register globals are off.  I do my best to always call htmlentities() for anything I am outputing that is derived from user input.  I also occasionally seach my database for common things used in xss attached such as...  &lt;script   What else should I be doing and how can I make sure that the things I am trying to do are always done.
86789
I don't have this kind of ID in my table, still MySQL is giving me a result.  This same result is giving when i place in my php code.
111051
How would you write a prepared MySQL statement in PHP that takes a differing number of arguments each time? An example such query is:  SELECT `age`, `name` FROM `people` WHERE id IN (12, 45, 65, 33)   The IN clause will have a different number of ids each time it is run.  I have two possible solutions in my mind but want to see if there is a better way.  Possible Solution 1 Make the statement accept 100 variables and fill the rest with dummy values guaranteed not to be in the table; make multiple calls for more than 100 values.  Possible Solution 2 Don't use a prepared statement; build and run the query checking stringently for possible injection attacks.
2735
I've heard that exposing database IDs (in URLs, for example) is a security risk, but I'm having trouble understanding why.  Any opinions or links on why it's a risk, or why it isn't?  EDIT: of course the access is scoped, e.g. if you can't see resource foo?id=123 you'll get an error page. Otherwise the URL itself should be secret.  EDIT: if the URL is secret, it will probably contain a generated token that has a limited lifetime, e.g. valid for 1 hour and can only be used once.  EDIT (months later): my current preferred practice for this is to use UUIDS for IDs and expose them. If I'm using sequential numbers (usually for performance on some DBs) as IDs I like generating a UUID token for each entry as an alternate key, and expose that.