Questions tagged [sql-injection]
SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution.
81
questions
1
vote
1answer
66 views
Recieving an XSS Injection: <script>alert('xssvuln');</script>
I would very much appreciate it if someone could review the php script below for any security risks.
I have a live website using shared hosting. There's a page that accepts text submissions from users....
3
votes
3answers
140 views
3
votes
1answer
230 views
Sanitizing user form input in php
Security threats in mind:
SQL Injections!!! --- Solutions: Prepared Statements (PDO) and including
$bpdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); in ...
3
votes
1answer
90 views
Does PDO::quote helps me to protect me against sql injection?
I have to process raw sql user input with Laravel. I've backed them up as follows:
...
6
votes
4answers
1k views
Regex to validate font names
/((([\w -]+)|("[\w -]+"))( *, *)?)+/
http://refiddle.com/18ql
I'm trying to use a PHP regex to sanitize a user input for a list of fonts. The above one seems to ...
2
votes
1answer
96 views
Does this PDO process look protected from SQL injection?
Does this process look protected from SQL injection attacks?
Is there something I could possibly change to make it more protected?
...
11
votes
1answer
196 views
Safe dynamic SQL for generic search
Prompted by discussion about SQL injection, I wanted to put a proof of concept forward to get feedback about whether this is in fact safe and protected against SQL injection or other malicious use. ...
3
votes
1answer
48 views
Displaying a user's uploaded posts
I'm working on prepared statements for my website and I'm wondering if it's possible to have multiple prepared statements one after another. In this example, I have 2 select statements. I'm hoping ...
1
vote
1answer
191 views
PHP MySQLi Prepared Statements: Can this select query be hacked/injected?
i want to know can this be hacked/injected?
...
3
votes
2answers
260 views
Database Model Security For Book Inventory
This code is one of the models developed for the Book Inventory application that is open for review. It is also based on a comment on this answer to a C# question. Based on the comment I did some ...
1
vote
1answer
78 views
PHP code for search page
Want to show you part of code that I wrote to process search request. User commit search by articles (codes) of products. The goal is to allow user write his search request to textarea element in any ...
3
votes
1answer
749 views
PHP code to insert phone number and IP address into a table if not already present
I am currently coding a PHP script that connects to a database and inserts a phone number and IP address if either item is not present in the table. I believe I have completed it and it is working but ...
3
votes
4answers
2k views
using $_POST array to prepare PDO statement with variables
I have been developing a little, private Blog Site to make notes/ stories of pen and paper rpg games available for me and my players.
This is my first project. As I am new to coding in PHP and MySQL ...
2
votes
2answers
91 views
2
votes
1answer
58 views
Showing all records on a webpage
I have a connection with my database to show all my records on a webpage, and I'm not sure if this code is safe:
...
1
vote
0answers
76 views
HTML file with a submit form
I have an HTML file that contains a submit form, which asks the users the fill in their personal info:
then it will post and store into the DB by method of PHP SQL:
...
30
votes
5answers
14k views
Creating ADODB Parameters on the fly
I have put together a small wrapper class to simplify creating parameterized ADODB queries with VB6/VBA. At this point I'm keeping things simple, so it's only supporting input parameters and from what ...
0
votes
1answer
64 views
Link shortening script
I wrote this script for a link shortener just for fun.
Is it safe, or is it very easy to inject SQL have other security shortcomings? Also, do you have any tips against MySQL injection?
I don't know ...
6
votes
1answer
615 views
PHP login script
I'm hoping someone would be able to identify if my code is prone to SQL injections, and just overall see if there is anything that could be done better.
This is also my first time using MySQLi ...
Sį“į“ Onį“į“į“
20.5k10 gold badges30 silver badges128 bronze badges
1
vote
0answers
484 views
Protection from SQL injection
I have this code, which is working correctly, but I am sure that it allows SQL injection attacks.
...
5
votes
1answer
253 views
Validating user supplied input
I was assigned a task to fix the SQL injection flaw reported by a code analysis tool. I am not the original author of the code. I am fairly knowledgeable with SQL.
...
-1
votes
1answer
2k views
Mysql flexible insert record with bind_param or bind_value
I want to insert rows in a database table with the precaution of SQL-injection. I'm using below flexible MySQL insert function, which enters a record in a given table. Is this the best approach or is ...
0
votes
1answer
172 views
PHP & MySQLi Login Script - Is it safe from Injection?
I've been geeking up on MySQLi prepared statements to avoid potential SQL injection and I have managed to modify my legacy code (previously just using mysqli_real_escape_string).
I am looking for ...
3
votes
2answers
113 views
User authentication SQL injection [closed]
Is this authentication mechanism vulnerable to SQL injection?
If so, how could one exploit it, and what is the most effective way to mitigate this?
...
0
votes
1answer
45 views
Checking whether a user is on the donors list
I was wondering if I could please get some justification if the PHP code I wrote using Mysqli prepared statements would be able to withstand SQL injection attacks.
I have one field that gets a value ...
1
vote
1answer
121 views
Prepared statements in PHP
I just heard of prepared statement in PHP and decided to prevent SQL injection with it and wrote a script testing it.
I would like to know what security threats this script can prevent, what security ...
2
votes
2answers
215 views
Email subscription queries for a PHP website
Is this code resistant against injection? I already used 'real-escape-string' but I don't know if this good enough. As you see I replaced my personal info. And the code does work. I'm building this ...
-1
votes
1answer
123 views
Searching for topic categories using mysqli [closed]
Is this code safe from injection, xss and whole other attacks or no ?
The below code is for search box :
...
3
votes
1answer
3k views
Function for inserting data into database
I have this function to ease out the task of inserting data into databases.
I am not very sure if it is secure to use it this way.
Any suggestions on improving it?
...
2
votes
1answer
202 views
Registering users bank account and logging in securely
I wrote a php script to register a user's bank account and I've tried to make the login as secure as possible, but I wonder if there are any flaws and is it's free from xss attacks and sql injection ...
5
votes
1answer
127 views
Updating an item's status in MS SQL Server using ODBC
Is the following query is vulnerable in terms of $itemstatus? I want to be sure about it. $yesorno is a user input which is ...
2
votes
1answer
134 views
Inserting a record into a MySQL table using PDO
Already many days I'm documenting about the SQL Injection. I was wondering if the code I wrote is vulnerable in some of its parts.
...
12
votes
4answers
5k views
Inserting robot moves into an SQLite3 database
I'm just wondering if you would consider this to be safe from SQL injection.
A peculiarity of my program is I need to dynamically access table names depending on my scenario.
This is not for ...
2
votes
3answers
3k views
Booking appointments with MySQLi and PHP
The following code books one appointment for one or more slots. I have never used database before, but have seen so many warnings regarding SQL injections. Since it has never affected me I have not ...
5
votes
2answers
2k views
Inserting a record into MySQL with a timestamp
I'm starting with PHP so I can save data to a MySQL database. I read a lot and it seems the "escape" strings is not so safe.
This is my code:
...
1
vote
1answer
88 views
Populate the database with new tweet data from the json_cache table
I'm really a newbie with code, and I wish to prepare all my statements to avoid SQL injection. I have searched a lot on the internet, but this wrapper/API doesn't look anything like the examples given....
1
vote
2answers
110 views
Security concern for SQL Injections/XSS
This question is everywhere, and I looked at many answers. A lot suggest using mysql_real_escape_string but that isn't an option, since it's depreciated now.
...
2
votes
2answers
1k views
PHP Dynamic QueryBuilder function - Security
This function is a working function, which builds a number of queries depending on the values of $_POST.
...
4
votes
1answer
81 views
Possibility of SQL Injection
I am requesting a review of a portion of a 600 lines of code. This portion of the code process a filter that is farther down the page. It takes in the parameters and formats them into a query. Now I ...
2
votes
1answer
160 views
Displaying subcategories of subcategories
I wanted to know if this code is safe against SQL injection or not?
Also do I need to mysqli_close if I already did the ...
1
vote
1answer
215 views
Product inventory database
I just finished writing a program which working with a database. Throughout the process when working with people to get past some of the hurdles I faced I was ridiculed for my SQL statements. I have ...
3
votes
1answer
143 views
Stored procedure to query custom data tables as dynamic SQL
There's a lot going on here, but the background for why this is necessary is that there is a set schema, or 'core' set of tables that are prefixed with 'bu', and any core table can have a custom table ...
10
votes
3answers
1k views
Inserting OAuth data into a database
I am totally new to PHP. I just wrote a PHP script for google oauth to pull the data and insert into my database. I don't know if my code is vulnerable to SQL injection. Should I have used prepared ...
2
votes
1answer
434 views
Simultaneously searching listings by attributes such as category, title, postcode
Is the code below safe from SQL injection?
...
-1
votes
2answers
142 views
Validating users with MySQL
One of my friends told me that my validate.php file has some problems with SQL injections. Please feel free to commit it on GitHub.
...
-1
votes
1answer
106 views
Improving PHP Security of Login
One of my github issues is below. I am having some problems with my security, is there anything that I should or need to improve. Here is an example of code that I use, but throughout the script there ...
2
votes
2answers
97 views
3
votes
2answers
958 views
Increase view counter with each page view
My question is similar to before, but now the code has changed completely. I would like to understand if this code is vulnerable to mysql injection.
...
6
votes
2answers
10k views
PHP registration/login form
I'm fairly new to MySQLi and PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a mere amateur though.
I've created an ...
-1
votes
2answers
344 views
XSS vulnerability on website
I'm using these functions to filter all my input variables. I was quite confident it would protect my website from possible XSS and SQL injections, but there are still vulnerabilities.
Please suggest ...
