So I found My page to be very vulnerable to sql injection attacks, I wish to patch it but a bit confused where to start, Ive done some research and I think I should be using PDO, basically from what I understand I need to be Pre-making my statements and then parsing there input as a string, As this is the first time doing this I would like to make sure I'm going own the right path,   So for example, this statement in my login page php code:  $verify_pass = $dB1-&gt;query('SELECT * FROM accounts WHERE account="'.$compte.'" AND pass="'.$pass.'"');   It's to my understanding I should be changing this to   $verify_pass = $dB1-&gt;prepare('SELECT * FROM accounts WHERE account="?" AND pass="?"');           $stmt-&gt;bind_param("sss", $user, $pass);   and then save there input as $user, Would this work to prevent an sql injection attack, I would obviously need to do this for every user input surrounding the database but is this a step in the right direction?
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
99589
I am stuck on the prevent SOQL injection trailhead, where I am looking to determine which portions of the code I would need to invoke escapeSingleQuotes or whitelist to enable. I've made several attempts at investigation to little avail. I have appended my code are there any steps I would need to take. My goal is to assess the code to see how it works and what I would need to do.  public class Prevent_SOQL_Injection_Challenge {  public string textOne {get; set;} public string textTwo {get; set;} public string comparator {get; set;} public string numberOne {get; set;}  public List&lt;Supply__c&gt; whereclause_records {get; set;}   public PageReference stringSearchOne(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(textOne != null &amp;&amp; textOne!=''){             whereClause += 'name like  \'%'+string.escapeSingleQuotes(textOne)+'%\' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+whereClause+' Limit 10');     }      return null; }   public PageReference stringSearchTwo(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(textTwo != null &amp;&amp; textTwo!=''){             whereClause += 'Storage_Location__r.name like  \'%'+string.escapeSingleQuotes(textTwo)+'%\' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+whereClause+' Limit 10');     }      return null; }   public PageReference numberSearchOne(){     string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';     string whereClause = '';      if(numberOne != null &amp;&amp; comparator != null){         whereClause += 'Quantity__c '+comparator+' '+string.ValueOf(numberOne)+' ';     }      if(whereClause != ''){         whereclause_records = database.query(query+' where '+string.ValueOf(whereClause)+' Limit 10');     }      return null; } }
13602
I'm looking for the alternative of mysql_real_escape_string() for SQL Server. Is addslashes() my best option or there is another alternative function that can be used?  An alternative for mysql_error() would also be useful.
65043
Apparently, I can connect to MySQL (at least from my localhost) without having to provide any username or password. I can even put anything as username, as long as the password is empty. I have access to the information_schema and test databases. I can create tables. If I run SELECT USER() it returns the proper value randomstring@localhost, where the random string is whatever I used for username when I connected.  The mysql.user table contains root@localhost, root@127.0.0.1, @localhost and pma@localhost. I manually set encrypted passwords to all the records (UPDATE user SET password=...) and only root has any privileges, the other two records have "N" for all privileges. That record with the empty username looks suspicious, but I don't think it has anything to do with this and I think it was there from the beginning.  To make matters worse, if I add a user with a password, I can only connect using empty string as password (just like if I put anything as username). If I try to connect using the username I created and password I supplied when creating it (CREATE USER .. IDENTIFIED BY ..) it doesn't work.  Does anyone know what is wrong and how I can fix this?  Note: I am using MySQL 5.5.16 for Windows, provided by the XAMPP package.
108771
In the below scenario  i am Accepting the ID of object in the string form : What will be the best way to avoid the SQL injection for ASId.  public static List&lt;AB__c&gt;ABC(string ASId)         records = [select id, name,abc__c,der__f, from AB__c WHERE der__f = :ASId WITH SECURITY ENFORCED ORDER BY AB__c ASC NULLS LAST];
41834
Has anybody used a good obfuscator for PHP? I've tried some but they don't work for very big projects. They can't handle variables that are included in one file and used in another, for instance.  Or do you have any other tricks for stopping the spread of your code?
65216
I am dissecting some code and came across this,   $sql = 'SELECT page.*, author.name AS author, updator.name AS updator '      . 'FROM '.TABLE_PREFIX.'page AS page '      . 'LEFT JOIN '.TABLE_PREFIX.'user AS author ON author.id = page.created_by_id '      . 'LEFT JOIN '.TABLE_PREFIX.'user AS updator ON updator.id = page.updated_by_id '      . 'WHERE slug = ? AND parent_id = ? AND (status_id='.Page::STATUS_REVIEWED.' OR status_id='.Page::STATUS_PUBLISHED.' OR status_id='.Page::STATUS_HIDDEN.')';   I am wondering what the "?" does in the WHERE statement.  Is it some sort of parameter holder?
109076
I've been getting some bots trying to get hold of my database by mass attacking /sertup/scripts.php of various database program. I wanna ban such activities.  The closest I found was this:   What is the best way, or is there any scripts to ban bots from attacking?  Thanks.
51549
What's wrong with this query: INSERT INTO Users( weight, desiredWeight ) VALUES ( 160, 145 ) WHERE id = 1;  It works without the WHERE clause. I've seemed to have forgot my SQL.
47691
I've heard that "everyone" is using parameterized SQL queries to protect against SQL injection attacks without having to vailidate every piece of user input.  How do you do this?  Do you get this automatically when using stored procedures?  So my understanding this is non-parameterized:    cmdText = String.Format("SELECT foo FROM bar WHERE baz = '{0}'", fuz)   Would this be parameterized?  cmdText = String.Format("EXEC foo_from_baz '{0}'", fuz)   Or do I need to do somethng more extensive like this in order to protect myself from SQL injection?  With command     .Parameters.Count = 1     .Parameters.Item(0).ParameterName = "@baz"     .Parameters.Item(0).Value = fuz End With   Are there other advantages to using parameterized queries besides the security considerations?  Update:  This great article was linked in one of the questions references by Grotok.
53962
I have a pretty active discussion on SO right now, about giving an answer, that could potentially harm the questioner. The question is  and discussion is in comments to .   In short, the OP asks for a way to implement a really dangerous thing. I've provided an answer to the question with a lot of warnings, while  told me that this is a very bad idea, and it is better to use prepared statements, and so on. He is absolutely right; I'm among those who upvoted his answer, but the question remains.   So, I would like to hear community's opinion on that topic. Should we protect others from shooting in their legs, or let them have responsibility to do it, if they want?  Update: One of my university teachers created  site (long ago). The idea of that site is to allow people training their SQL skills. I won't tell much about the site, you can register and check it out yourself (it is available in english), but the whole idea is just the same: execute SQL provided by the user. Of course it is fltered, checked that it is safe, placed in a sandbox, etc. But the concept is just the same. It's rather popular resource, it is on third place in  and have large and growing community. I hope this update will stimulate further discussion.
24749
At the moment, I apply a 'throw everything at the wall and see what sticks' method of stopping the aforementioned issues. Below is the function I have cobbled together:  function madSafety($string) {  $string = mysql_real_escape_string($string); $string = stripslashes($string); $string = strip_tags($string); return $string;  }   However, I am convinced that there is a better way to do this. I am using FILTER_ SANITIZE_STRING and this doesn't appear to to totally secure.   I guess I am asking, which methods do you guys employ and how successful are they? Thanks
27610
I'm receiving the following warnings when I use mysql_query() in my modules:  mysql_query(): A link to the server could not be established in ...... on line 6  If I use db_query() instead, it works fine.   The code is a simple SELECT query with no special characters or variables. The actual query is mysql_query("SELECT * FROM custom_nodify WHERE nid = 345");  I should mention that this happens with ANY mysql_query(), not just the one above.  Any suggestions as to why this doesn't work?
19638
I am trying to INSERT INTO a table using the input from another table. Although this is entirely feasible for many database engines, I always seem to struggle to remember the correct syntax for the SQL engine of the day (, , , , and ).  Is there a silver-bullet syntax coming from an SQL standard (for example, ) that would allow me to insert the values without worrying about the underlying database?
26532
I'm trying to write a page that calls PHP that's stored in a MySQL database. The page that is stored in the MySQL database contains PHP (and HTML) code which I want to run on page load.  How could I go about doing this?
119920
I'm working on an application for work that is going to query our employee database. The end users want the ability to search based on the standard name/department criteria, but they also want the flexibility to query for all people with the first name of "James" that works in the Health Department. The one thing I want to avoid is to simply have the stored procedure take a list of parameters and generate a SQL statement to execute, since that would open doors to SQL injection at an internal level.  Can this be done?
22185
I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm starting to worry since they are getting more common (last month I got 2 attacks, and on november 7th there are 3 attempts already (1st, 4th and 6th of nov).  I'm not really concerned about it, since I don't have any database. All the info i have on that server is absolutely public, but I'm worried about that attacking-rate increase.  So I thought I could -temporarily- block the IPs that come from those attackers, or something that could make my server ignore requests that ask for phpMyAdmin, pma, xamp, etc.  Is there something like that? my server is Linux+Apache+Php