Problem  I have the below snippet in a website that I'm building at the moment. I know it is not secure due to SQL injection etc. but what is the correct way to solve that? I see related questions asking the same thing but with MySQL, and for that there is PDO, but PDO_OCI is experimental so I don't want to use it.  What other options do I have? Do I just create a function to strip certain characters and wrap that around the $_POST, something like str_replace(';', '', $_POST['username']);?  The below snippet is the only part of the website that actually takes user input, $_POST, in a query so I just need to make sure that I get the below correct.  Code  &lt;?php  if (!empty($_POST)) {    $stid = oci_parse($conn, "SELECT CustomerNo FROM Customers WHERE Username = '" . $_POST['username'] . "' AND Password = '" . $_POST['password'] . "'");   oci_execute($stid);    $row = oci_fetch_array($stid, OCI_NUM);   if (!empty($row['0'])) {      session_start();     $_SESSION['customer'] = $row['0'];     $_SESSION['username'] = $_POST['username'];    }    oci_free_statement($stid);   oci_close($conn);  }  ?&gt;
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
108771
In the below scenario  i am Accepting the ID of object in the string form : What will be the best way to avoid the SQL injection for ASId.  public static List&lt;AB__c&gt;ABC(string ASId)         records = [select id, name,abc__c,der__f, from AB__c WHERE der__f = :ASId WITH SECURITY ENFORCED ORDER BY AB__c ASC NULLS LAST];
65216
I am dissecting some code and came across this,   $sql = 'SELECT page.*, author.name AS author, updator.name AS updator '      . 'FROM '.TABLE_PREFIX.'page AS page '      . 'LEFT JOIN '.TABLE_PREFIX.'user AS author ON author.id = page.created_by_id '      . 'LEFT JOIN '.TABLE_PREFIX.'user AS updator ON updator.id = page.updated_by_id '      . 'WHERE slug = ? AND parent_id = ? AND (status_id='.Page::STATUS_REVIEWED.' OR status_id='.Page::STATUS_PUBLISHED.' OR status_id='.Page::STATUS_HIDDEN.')';   I am wondering what the "?" does in the WHERE statement.  Is it some sort of parameter holder?
61016
I realize that parameterized SQL queries is the optimal way to sanitize user input when building queries that contain user input, but I'm wondering what is wrong with taking user input and escaping any single quotes and surrounding the whole string with single quotes. Here's the code:  sSanitizedInput = "'" &amp; Replace(sInput, "'", "''") &amp; "'"   Any single-quote the user enters is replaced with double single-quotes, which eliminates the users ability to end the string, so anything else they may type, such as semicolons, percent signs, etc., will all be part of the string and not actually executed as part of the command.    We are using Microsoft SQL Server 2000, for which I believe the single-quote is the only string delimiter and the only way to escape the string delimiter, so there is no way to execute anything the user types in.  I don't see any way to launch an SQL injection attack against this, but I realize that if this were as bulletproof as it seems to me someone else would have thought of it already and it would be common practice.    What's wrong with this code? Is there a way to get an SQL injection attack past this sanitization technique?  Sample user input that exploits this technique would be very helpful.    UPDATE:  I still don't know of any way to effectively launch a SQL injection attack against this code. A few people suggested that a backslash would escape one single-quote and leave the other to end the string so that the rest of the string would be executed as part of the SQL command, and I realize that this method would work to inject SQL into a MySQL database, but in SQL&nbsp;Server 2000 the only way (that I've been able to find) to escape a single-quote is with another single-quote; backslashes won't do it.  And unless there is a way to stop the escaping of the single-quote, none of the rest of the user input will be executed because it will all be taken as one contiguous string.  I understand that there are better ways to sanitize input, but I'm really more interested in learning why the method I provided above won't work. If anyone knows of any specific way to mount a SQL injection attack against this sanitization method I would love to see it.
7196
Is there an easy way to run a MySQL query from the Linux command line and output the results in  format?  Here's what I'm doing now:  mysql -u uid -ppwd -D dbname &lt;&lt; EOQ | sed -e 's/        /,/g' | tee list.csv select id, concat("\"",name,"\"") as name from students EOQ   It gets messy when there are a lot of columns that need to be surrounded by quotes, or if there are quotes in the results that need to be escaped.
59811
Here is the script to create my tables:   CREATE TABLE clients (    client_i INT(11),    PRIMARY KEY (client_id) ); CREATE TABLE projects (    project_id INT(11) UNSIGNED,    client_id INT(11) UNSIGNED,    PRIMARY KEY (project_id) ); CREATE TABLE posts (    post_id INT(11) UNSIGNED,    project_id INT(11) UNSIGNED,    PRIMARY KEY (post_id) );   In my PHP code, when deleting a client, I want to delete all projects posts:  DELETE  FROM posts INNER JOIN projects ON projects.project_id = posts.project_id WHERE projects.client_id = :client_id;   The posts table does not have a foreign key client_id, only project_id. I want to delete the posts in projects that have the passed client_id.  This is not working right now because no posts are deleted.
6749
What are the best workarounds for using a SQL IN clause with instances of java.sql.PreparedStatement, which is not supported for multiple values due to SQL injection attack security issues: One ? placeholder represents one value, rather than a list of values.  Consider the following SQL statement:  SELECT my_column FROM my_table where search_column IN (?)   Using preparedStatement.setString( 1, "'A', 'B', 'C'" ); is essentially a non-working attempt at a workaround of the reasons for using ? in the first place.    What workarounds are available?
116292
I'm setting up a public site and the first thing on my mind is SQL injection. I have some text fields I'm saving and am using linq to update/write to the database. Am I safe using linq?   This example is creating the user account.   Data.MemberRegistrationDataContext context = new MemberRegistrationDataContext(); Data.tbl_Member_UserProfile profile = new tbl_Member_UserProfile(); profile.SSN = Convert.ToDecimal(Session["tempMemberSSN_Registration"]); profile.UserName = userName; profile.Password = password; profile.EmailAddress = email; profile.QuestionID = qID; profile.QuestionResponse = securityAnswer; profile.LastModDt = DateTime.Now; profile.LastModBy = "web"; context.tbl_Member_UserProfiles.InsertOnSubmit(profile); context.SubmitChanges();   This example is changing the password     MemberRegistrationDataContext dc = new MemberRegistrationDataContext();    var mProfileRecord = dc.tbl_Member_UserProfiles.Single(c =&gt; c.SSN == sSSN);    mProfileRecord.Password = sNewPassword;    dc.SubmitChanges();   Are these safe? Does LINQ parameterize the SQL it generates automatically?
3752
I have PHP configured so that magic quotes are on and register globals are off.  I do my best to always call htmlentities() for anything I am outputing that is derived from user input.  I also occasionally seach my database for common things used in xss attached such as...  &lt;script   What else should I be doing and how can I make sure that the things I am trying to do are always done.
47815
What is a strong way to protect against sql injection for a classic asp app?  FYI I am using it with an access DB.  (I didnt write the app)
41834
Has anybody used a good obfuscator for PHP? I've tried some but they don't work for very big projects. They can't handle variables that are included in one file and used in another, for instance.  Or do you have any other tricks for stopping the spread of your code?
112966
I want to make sure all of the data in my plugins/themes is handled securely  before entering the database and before being output to the browser. My problem is that there are situations where the API handles the sanitization for you -- like when saving post meta fields -- and others where the plugin/theme author is wholly responsible for doing it -- like when saving custom settings.  For the scope of this question, I'm not concerned about validating data at the domain level -- e.g., checking that an Age field on a form is between 0 and 120, or that an e-mail address is valid. I'm only concerned about security -- e.g., escaping SQL queries to avoid SQL injection when saving to the database, or sanitizing data that's output to HTML templates to avoid XSS.  For output sanitization, I know that you always need to use functions like esc_html() and esc_attr() when echo'ing variables into HTML templates. But, what about when using ? Do they all sanitize the output already? If so, for which context (general HTML, tag attributes, etc)? Some functions have variants for different contexts (like the_title_attribute(), but most don't.  For input sanitization, I know that I need to use $wpdb-&gt;prepare() when making manual queries, but what about when using the Settings API to create a plugin settings page, or saving post meta fields for a custom post type?  Right now I've just been digging through Core and reading tutorials every time I use a function to find out if it sanitizes or not, but that's error-prone and time consuming. I'm hoping to find some kind of comprehensive list of all the possible situations and whether or not the API handles it. e.g.,  API validates/sanitizes   Saving post meta with update_postmeta() Saving user meta with update_user_meta() Outputting a post title - use the contextually appropriate variant of the_title() etc   You have to manually validate/sanitize   Saving plugin options with the Settings API. Pass a callback as the 3rd parameter of register_setting(). Direct database queries: Wrap the query in $wpdb-&gt;prepare(). Outputting variables in HTML. Use esc_attr(), esc_html(), etc etc   I'd also be interested to understand why the API provides it in certain situations, but not others. I'm assuming it has something to do with the unknown nature of the data, but would love to hear a thorough explanation.
111051
How would you write a prepared MySQL statement in PHP that takes a differing number of arguments each time? An example such query is:  SELECT `age`, `name` FROM `people` WHERE id IN (12, 45, 65, 33)   The IN clause will have a different number of ids each time it is run.  I have two possible solutions in my mind but want to see if there is a better way.  Possible Solution 1 Make the statement accept 100 variables and fill the rest with dummy values guaranteed not to be in the table; make multiple calls for more than 100 values.  Possible Solution 2 Don't use a prepared statement; build and run the query checking stringently for possible injection attacks.
30396
I'm programmatically creating a user with the following code.  $newUser = array(   'name' =&gt; $mail,    'pass' =&gt; 'password',  // note: do not md5 the password   'mail' =&gt; $mail,    'status' =&gt; 1,    'init' =&gt; $mail,   'roles' =&gt; array(5) ); $user = user_save(null, $newUser);   I have got a role with the role ID equal to 5; when I create the user, in the table "users_roles" there is only a row with the value 0 for the role ID, but if I print the user object with var_dump(), it looks like the roles are created.  What am I doing wrong?
836
I'm writing a php program that pulls from a database source. Some of the varchars have quotes that are displaying as black diamonds with a question mark in them (�, , I assume from Microsoft Word text).  How can I use php to strip these characters out?
8186
is there an alternative for mysql_insert_id() php function for PostgreSQL? Most of the frameworks are solving the problem partially by finding the current value of the sequence used in the ID. However, there are times that the primary key is not a serial column....
7387
Can someone explain SQL injection?  How does it cause vulnerabilities?  Where exactly is the point where SQL is injected?