Questions tagged [sql-injection]

SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution.

Filter by
Sorted by
Tagged with
27
votes
5answers
13k views

Creating ADODB Parameters on the fly

I have put together a small wrapper class to simplify creating parameterized ADODB queries with VB6/VBA. At this point I'm keeping things simple, so it's only supporting input parameters and from what ...
12
votes
4answers
5k views

Inserting robot moves into an SQLite3 database

I'm just wondering if you would consider this to be safe from SQL injection. A peculiarity of my program is I need to dynamically access table names depending on my scenario. This is not for ...
10
votes
4answers
808 views

Listing products from a database

I've this function to list products from database by category. I'm using prepared statements, but wouldn't this make it pretty pointless to use them? ...
10
votes
2answers
777 views

SQL injection safety check

I was wondering if my code is safe for sql injection. This code just checks if the username exists in my db or not. ...
9
votes
4answers
1k views

Inserting 1 line into my SQL database

This is for adding code into my table really easily, however it will be called 2000+ times per second, so I need to know if this is the most efficient code to add a row to the database. ...
9
votes
3answers
1k views

Inserting OAuth data into a database

I am totally new to PHP. I just wrote a PHP script for google oauth to pull the data and insert into my database. I don't know if my code is vulnerable to SQL injection. Should I have used prepared ...
8
votes
0answers
158 views

Safe dynamic SQL for generic search

Prompted by discussion about SQL injection, I wanted to put a proof of concept forward to get feedback about whether this is in fact safe and protected against SQL injection or other malicious use. ...
7
votes
2answers
973 views

Preventing SQL injection by converting all characters to their ASCII values

In order to prevent SQL injection, I'm converting every character of a string to be inserted in the database into its ASCII value before performing the query. In order to read the value of the string ...
7
votes
2answers
2k views

User registration and login

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
6
votes
2answers
2k views

Converting multiple query to use parameters to avoid SQL injection

I have some dropdownlist in my aspx page and I am using the choices from them in my SQL query: ...
6
votes
2answers
207 views

How is my injection protection?

What do I need to do to prevent injections? In addition, if I have any statement/parameter errors, please tell me. ...
6
votes
1answer
130 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
6
votes
1answer
285 views

mysql_safe_query()

I have been thinking of a sql-injection free implementation in dynamic languages. Here's what I came with. All the code was written just for fun and learning purposes. I would like to share it and ...
6
votes
2answers
10k views

PHP registration/login form

I'm fairly new to MySQLi and PHP, but I've been working at it for a bit now, and reading up on how to make secure login forms, avoid SQL injection etc. I'm a mere amateur though. I've created an ...
5
votes
2answers
1k views

Possible SQL injection vulnerability searching for a product by ID?

I want to be sure that this isn't vulnerable to SQL injection. If yes, then how can it be improved? ...
5
votes
6answers
2k views

Using OLEDB to connect to a MS Access 2007 file

I am working on a program which use OLEDB to connect to a MS Access 2007 file. My program has a possibility to add and delete records from file by using SQL statements which select deleted item by ID. ...
5
votes
3answers
998 views

Regex to validate font names

/((([\w -]+)|("[\w -]+"))( *, *)?)+/ http://refiddle.com/18ql I'm trying to use a PHP regex to sanitize a user input for a list of fonts. The above one seems to ...
5
votes
1answer
246 views

Validating user supplied input

I was assigned a task to fix the SQL injection flaw reported by a code analysis tool. I am not the original author of the code. I am fairly knowledgeable with SQL. ...
5
votes
2answers
2k views

Inserting a record into MySQL with a timestamp

I'm starting with PHP so I can save data to a MySQL database. I read a lot and it seems the "escape" strings is not so safe. This is my code: ...
5
votes
1answer
4k views

Making VBA generated dynamic SQL statements safe against injection

I need to use SQL extensively in VBA macros that I write. Since the DB is from our enterprise application, I use vendor's library for this. I generate dynamic queries, sometimes with many ...
5
votes
1answer
421 views

PHP login script

I'm hoping someone would be able to identify if my code is prone to SQL injections, and just overall see if there is anything that could be done better. This is also my first time using MySQLi ...
5
votes
1answer
727 views

For a login portal, what security measures are needed to prevent unauthorized access?

I'm designing a login portal that has one angularjs page that displays/processes data queried from a database. I'm relying on a few php pages (a loginpage.php [verifies credentials/loads session ...
5
votes
1answer
127 views

Updating an item's status in MS SQL Server using ODBC

Is the following query is vulnerable in terms of $itemstatus? I want to be sure about it. $yesorno is a user input which is ...
4
votes
4answers
753 views

Adding entries to an MS Access file using OleDB

In the following piece of code I am adding entries to an MS Access file using OleDB. The purpose of this post is to point out my bad programming practices and if I have created any security flaws here....
4
votes
2answers
174 views

Injections and query

I made a class that connects to my DB and inserts some values. Is it secure or how can I protect this further from injections? The object declaration will come from variables with POST from a form, ...
4
votes
2answers
2k views

POST security with PDO?

So I have some code that works as PDO. But is it secure? I'm trying to prevent SQL injection. This is my first PDO script and was hoping to see if it was done correctly. Here it is. ...
4
votes
1answer
3k views

Using POST data to call a function from a specified class

I've inherited a class in a project which is purposed to execute a function that exists in POST data from a specified class. I've tried to clean this up as much as possible as well as secure it ...
3
votes
4answers
252 views

SQL-injection mitigation script

I'll gladly appreciate it if you could review my code below and let me know if they are sufficiently secure. My main website and these scripts will use same database, so I need to make sure they are ...
3
votes
2answers
437 views

Confirming safety of SQL injection

I believe with everyone's help on Stack Overflow, I got my code safe guarded from SQL injection. I'm trying to confirm that is correct, just in case I misinterpreted the help and advice I received. <...
3
votes
2answers
252 views

Database Model Security For Book Inventory

This code is one of the models developed for the Book Inventory application that is open for review. It is also based on a comment on this answer to a C# question. Based on the comment I did some ...
3
votes
1answer
140 views

Stored procedure to query custom data tables as dynamic SQL

There's a lot going on here, but the background for why this is necessary is that there is a set schema, or 'core' set of tables that are prefixed with 'bu', and any core table can have a custom table ...
3
votes
2answers
107 views

User authentication SQL injection [closed]

Is this authentication mechanism vulnerable to SQL injection? If so, how could one exploit it, and what is the most effective way to mitigate this? ...
3
votes
2answers
901 views

Increase view counter with each page view

My question is similar to before, but now the code has changed completely. I would like to understand if this code is vulnerable to mysql injection. ...
3
votes
1answer
77 views

Possibility of SQL Injection

I am requesting a review of a portion of a 600 lines of code. This portion of the code process a filter that is farther down the page. It takes in the parameters and formats them into a query. Now I ...
3
votes
1answer
423 views

Secure login system

The assignment is to create a login system secured for SQL injections and XSS. It's in PHP and I'm using PDO with prepared statements obviously. Which from my point of view should protect against the ...
3
votes
1answer
392 views

PHP code to insert phone number and IP address into a table if not already present

I am currently coding a PHP script that connects to a database and inserts a phone number and IP address if either item is not present in the table. I believe I have completed it and it is working but ...
3
votes
1answer
196 views

Calling a MySQL procedure with an arbitrary parameter on a GoDaddy website

I'm deploying a PHP project, and I always try to use prepared statements, but unfortunately, GoDaddy does not have the mod mysqlnd which I use it for the function ...
3
votes
1answer
3k views

Codeigniter active record

I understand that I should use prepared statements to prevent SQL injection. Unfortunately, having read the PHP docs on the matter I am none the wiser. Here is one of my simple active record SQL ...
3
votes
1answer
44 views

Displaying a user's uploaded posts

I'm working on prepared statements for my website and I'm wondering if it's possible to have multiple prepared statements one after another. In this example, I have 2 select statements. I'm hoping ...
2
votes
3answers
5k views

A very secure procedural MySQLI login script against injections

I know there are other ways to create a login script like Object Oriented, Prepared Statements and PDO, but how about those old MySQL PHP users like me trying to change from old style to the new ways? ...
2
votes
2answers
193 views

Email subscription queries for a PHP website

Is this code resistant against injection? I already used 'real-escape-string' but I don't know if this good enough. As you see I replaced my personal info. And the code does work. I'm building this ...
2
votes
3answers
2k views

Booking appointments with MySQLi and PHP

The following code books one appointment for one or more slots. I have never used database before, but have seen so many warnings regarding SQL injections. Since it has never affected me I have not ...
2
votes
2answers
768 views

PHP Dynamic QueryBuilder function - Security

This function is a working function, which builds a number of queries depending on the values of $_POST. ...
2
votes
2answers
215 views

Inserting e-mail subscribers into MySQL

I'm new to Python and I am learning database connections from here. This is the code I am using to insert e-mail subscribers into a table: ...
2
votes
4answers
781 views

using $_POST array to prepare PDO statement with variables

I have been developing a little, private Blog Site to make notes/ stories of pen and paper rpg games available for me and my players. This is my first project. As I am new to coding in PHP and MySQL ...
2
votes
1answer
130 views

Inserting a record into a MySQL table using PDO

Already many days I'm documenting about the SQL Injection. I was wondering if the code I wrote is vulnerable in some of its parts. ...
2
votes
1answer
487 views

Securing a form with image uploads

I am using PDO prepared statements to store user entered input and store that input to the database. The code will store a text input and 5 uploaded images. Will this code protect from data SQL ...
2
votes
2answers
89 views
2
votes
1answer
57 views

Showing all records on a webpage

I have a connection with my database to show all my records on a webpage, and I'm not sure if this code is safe: ...
2
votes
1answer
3k views

Function for inserting data into database

I have this function to ease out the task of inserting data into databases. I am not very sure if it is secure to use it this way. Any suggestions on improving it? ...