Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution.

1
vote
1answer
45 views

HTML file with a submit form

I have an HTML file that contains a submit form, which asks the users the fill in their personal info: then it will post and store into the DB by method of PHP SQL: ...
5
votes
1answer
150 views

PHP login script

I'm hoping someone would be able to identify if my code is prone to SQL injections, and just overall see if there is anything that could be done better. This is also my first time using MySQLi ...
1
vote
0answers
274 views

Protection from SQL injection

I have this code, which is working correctly, but I am sure that it allows SQL injection attacks. ...
-1
votes
1answer
349 views

Mysql flexible insert record with bind_param or bind_value

I want to insert rows in a database table with the precaution of SQL-injection. I'm using below flexible MySQL insert function, which enters a record in a given table. Is this the best approach or is ...
0
votes
1answer
129 views

PHP & MySQLi Login Script - Is it safe from Injection?

I've been geeking up on MySQLi prepared statements to avoid potential SQL injection and I have managed to modify my legacy code (previously just using mysqli_real_escape_string). I am looking for ...
2
votes
2answers
100 views

User authentication SQL injection [closed]

Is this authentication mechanism vulnerable to SQL injection? If so, how could one exploit it, and what is the most effective way to mitigate this? ...
0
votes
1answer
45 views

Checking whether a user is on the donors list

I was wondering if I could please get some justification if the PHP code I wrote using Mysqli prepared statements would be able to withstand SQL injection attacks. I have one field that gets a value ...
0
votes
1answer
56 views

Link shortening script

I wrote this script for a link shortener just for fun. Is it safe, or is it very easy to inject SQL have other security shortcomings? Also, do you have any tips against MySQL injection? I don't know ...
1
vote
1answer
98 views

Prepared statements in PHP

I just heard of prepared statement in PHP and decided to prevent SQL injection with it and wrote a script testing it. I would like to know what security threats this script can prevent, what security ...
2
votes
2answers
103 views

Email subscription queries for a PHP website

Is this code resistant against injection? I already used 'real-escape-string' but I don't know if this good enough. As you see I replaced my personal info. And the code does work. I'm building this ...
-1
votes
1answer
71 views

Searching for topic categories using mysqli [closed]

Is this code safe from injection, xss and whole other attacks or no ? The below code is for search box : ...
3
votes
1answer
161 views

Registering users bank account and logging in securely

I wrote a php script to register a user's bank account and I've tried to make the login as secure as possible, but I wonder if there are any flaws and is it's free from xss attacks and sql injection ...
2
votes
3answers
1k views

Booking appointments with MySQLi and PHP

The following code books one appointment for one or more slots. I have never used database before, but have seen so many warnings regarding SQL injections. Since it has never affected me I have not ...
2
votes
1answer
1k views

Function for inserting data into database

I have this function to ease out the task of inserting data into databases. I am not very sure if it is secure to use it this way. Any suggestions on improving it? ...
12
votes
4answers
5k views

Inserting robot moves into an SQLite3 database

I'm just wondering if you would consider this to be safe from SQL injection. A peculiarity of my program is I need to dynamically access table names depending on my scenario. This is not for ...
5
votes
2answers
864 views

Inserting a record into MySQL with a timestamp

I'm starting with PHP so I can save data to a MySQL database. I read a lot and it seems the "escape" strings is not so safe. This is my code: ...
2
votes
1answer
99 views

Inserting a record into a MySQL table using PDO

Already many days I'm documenting about the SQL Injection. I was wondering if the code I wrote is vulnerable in some of its parts. ...
1
vote
2answers
102 views

Security concern for SQL Injections/XSS

This question is everywhere, and I looked at many answers. A lot suggest using mysql_real_escape_string but that isn't an option, since it's depreciated now. ...
2
votes
2answers
322 views

PHP Dynamic QueryBuilder function - Security

This function is a working function, which builds a number of queries depending on the values of $_POST. ...
3
votes
1answer
73 views

Possibility of SQL Injection

I am requesting a review of a portion of a 600 lines of code. This portion of the code process a filter that is farther down the page. It takes in the parameters and formats them into a query. Now I ...
1
vote
1answer
180 views

Product inventory database

I just finished writing a program which working with a database. Throughout the process when working with people to get past some of the hurdles I faced I was ridiculed for my SQL statements. I have ...
3
votes
1answer
117 views

Stored procedure to query custom data tables as dynamic SQL

There's a lot going on here, but the background for why this is necessary is that there is a set schema, or 'core' set of tables that are prefixed with 'bu', and any core table can have a custom table ...
9
votes
3answers
1k views

Inserting OAuth data into a database

I am totally new to PHP. I just wrote a PHP script for google oauth to pull the data and insert into my database. I don't know if my code is vulnerable to SQL injection. Should I have used prepared ...
-1
votes
1answer
100 views

Improving PHP Security of Login

One of my github issues is below. I am having some problems with my security, is there anything that I should or need to improve. Here is an example of code that I use, but throughout the script there ...
-1
votes
2answers
136 views

Validating users with MySQL

One of my friends told me that my validate.php file has some problems with SQL injections. Please feel free to commit it on GitHub. ...
2
votes
2answers
94 views

Read and display data from MySQL table

Is there any security threat here? ...
4
votes
2answers
760 views

Increase view counter with each page view

My question is similar to before, but now the code has changed completely. I would like to understand if this code is vulnerable to mysql injection. ...
-2
votes
2answers
74 views

Authentication check in index.php file

I am aware that this code is vulnerable for SQL injections, but I don't know how to avoid it. ...
6
votes
1answer
239 views

mysql_safe_query()

I have been thinking of a sql-injection free implementation in dynamic languages. Here's what I came with. All the code was written just for fun and learning purposes. I would like to share it and ...
5
votes
1answer
242 views

Validating user supplied input

I was assigned a task to fix the SQL injection flaw reported by a code analysis tool. I am not the original author of the code. I am fairly knowledgeable with SQL. ...
3
votes
1answer
375 views

Secure login system

The assignment is to create a login system secured for SQL injections and XSS. It's in PHP and I'm using PDO with prepared statements obviously. Which from my point of view should protect against the ...
2
votes
3answers
4k views

A very secure procedural MySQLI login script against injections

I know there are other ways to create a login script like Object Oriented, Prepared Statements and PDO, but how about those old MySQL PHP users like me trying to change from old style to the new ways? ...
5
votes
1answer
628 views

For a login portal, what security measures are needed to prevent unauthorized access?

I'm designing a login portal that has one angularjs page that displays/processes data queried from a database. I'm relying on a few php pages (a loginpage.php [verifies credentials/loads session ...
1
vote
1answer
80 views

Populate the database with new tweet data from the json_cache table

I'm really a newbie with code, and I wish to prepare all my statements to avoid SQL injection. I have searched a lot on the internet, but this wrapper/API doesn't look anything like the examples given....
7
votes
2answers
935 views

Preventing SQL injection by converting all characters to their ASCII values

In order to prevent SQL injection, I'm converting every character of a string to be inserted in the database into its ASCII value before performing the query. In order to read the value of the string ...
6
votes
2answers
9k views

PHP registration/login form

I'm fairly new to MySQLi and PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a mere amateur though. I've created an ...
2
votes
1answer
422 views

Securing a form with image uploads

I am using PDO prepared statements to store user entered input and store that input to the database. The code will store a text input and 5 uploaded images. Will this code protect from data SQL ...
5
votes
2answers
1k views

Possible SQL injection vulnerability searching for a product by ID?

I want to be sure that this isn't vulnerable to SQL injection. If yes, then how can it be improved? ...
2
votes
2answers
212 views

Inserting e-mail subscribers into MySQL

I'm new to Python and I am learning database connections from here. This is the code I am using to insert e-mail subscribers into a table: ...
3
votes
1answer
182 views

Calling a MySQL procedure with an arbitrary parameter on a GoDaddy website

I'm deploying a PHP project, and I always try to use prepared statements, but unfortunately, GoDaddy does not have the mod mysqlnd which I use it for the function ...
5
votes
1answer
124 views

Updating an item's status in MS SQL Server using ODBC

Is the following query is vulnerable in terms of $itemstatus? I want to be sure about it. $yesorno is a user input which is ...
6
votes
2answers
2k views

Converting multiple query to use parameters to avoid SQL injection

I have some dropdownlist in my aspx page and I am using the choices from them in my SQL query: ...
-1
votes
2answers
302 views

XSS vulnerability on website

I'm using these functions to filter all my input variables. I was quite confident it would protect my website from possible XSS and SQL injections, but there are still vulnerabilities. Please suggest ...
0
votes
2answers
147 views

Does this code avoid SQL injection? [closed]

I have the following PHP code but I'm unsure, based on the many things I've read, whether or not this is actually safe from an SQL injection attack. ...
6
votes
1answer
121 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
9
votes
4answers
1k views

Inserting 1 line into my SQL database

This is for adding code into my table really easily, however it will be called 2000+ times per second, so I need to know if this is the most efficient code to add a row to the database. ...
5
votes
3answers
855 views

Regex to validate font names

/((([\w -]+)|("[\w -]+"))( *, *)?)+/ http://refiddle.com/18ql I'm trying to use a PHP regex to sanitize a user input for a list of fonts. The above one seems to ...
10
votes
2answers
748 views

SQL injection safety check

I was wondering if my code is safe for sql injection. This code just checks if the username exists in my db or not. ...
7
votes
2answers
2k views

User registration and login

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
4
votes
2answers
2k views

POST security with PDO?

So I have some code that works as PDO. But is it secure? I'm trying to prevent SQL injection. This is my first PDO script and was hoping to see if it was done correctly. Here it is. ...