Questions tagged [sql-injection]

SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution.

Filter by
Sorted by
Tagged with
6
votes
2answers
2k views

Converting multiple query to use parameters to avoid SQL injection

I have some dropdownlist in my aspx page and I am using the choices from them in my SQL query: ...
-1
votes
2answers
334 views

XSS vulnerability on website

I'm using these functions to filter all my input variables. I was quite confident it would protect my website from possible XSS and SQL injections, but there are still vulnerabilities. Please suggest ...
0
votes
2answers
150 views

Does this code avoid SQL injection? [closed]

I have the following PHP code but I'm unsure, based on the many things I've read, whether or not this is actually safe from an SQL injection attack. ...
6
votes
1answer
130 views

Secure way to store passwords

Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in ...
9
votes
4answers
1k views

Inserting 1 line into my SQL database

This is for adding code into my table really easily, however it will be called 2000+ times per second, so I need to know if this is the most efficient code to add a row to the database. ...
5
votes
3answers
993 views

Regex to validate font names

/((([\w -]+)|("[\w -]+"))( *, *)?)+/ http://refiddle.com/18ql I'm trying to use a PHP regex to sanitize a user input for a list of fonts. The above one seems to ...
10
votes
2answers
777 views

SQL injection safety check

I was wondering if my code is safe for sql injection. This code just checks if the username exists in my db or not. ...
7
votes
2answers
2k views

User registration and login

I am doubtful about the security of my PHP code. I am new to programming, but want to learn how to secure things, protect my databases from SQL injection, and other best practices. I'd like to know if ...
4
votes
2answers
2k views

POST security with PDO?

So I have some code that works as PDO. But is it secure? I'm trying to prevent SQL injection. This is my first PDO script and was hoping to see if it was done correctly. Here it is. ...
4
votes
2answers
174 views

Injections and query

I made a class that connects to my DB and inserts some values. Is it secure or how can I protect this further from injections? The object declaration will come from variables with POST from a form, ...
1
vote
2answers
151 views

SQL Injection when not using variables

Do I still need to protect my code against SQL injection when I'm not using variables in SQL queries? Is this code still vulnerable?: ...
2
votes
1answer
157 views

Displaying subcategories of subcategories

I wanted to know if this code is safe against SQL injection or not? Also do I need to mysqli_close if I already did the ...
1
vote
2answers
98 views

Where to protect DB data against XSS injections?

To protect my web site against XSS injection, I am using OWASP Encoding Project. Is it a good idea to protect all data retrieved in my DB to avoid XSS by going throuh all the data just returned by ...
6
votes
2answers
207 views

How is my injection protection?

What do I need to do to prevent injections? In addition, if I have any statement/parameter errors, please tell me. ...
1
vote
1answer
687 views

How safe is my MySQL query?

I am using PDO for the first time in my project. In my previous project someone suggested me to use PDO as my queries were wide open to inject. I am pasting a sample code of my project. Can you ...
10
votes
4answers
808 views

Listing products from a database

I've this function to list products from database by category. I'm using prepared statements, but wouldn't this make it pretty pointless to use them? ...
27
votes
5answers
13k views

Creating ADODB Parameters on the fly

I have put together a small wrapper class to simplify creating parameterized ADODB queries with VB6/VBA. At this point I'm keeping things simple, so it's only supporting input parameters and from what ...
5
votes
1answer
4k views

Making VBA generated dynamic SQL statements safe against injection

I need to use SQL extensively in VBA macros that I write. Since the DB is from our enterprise application, I use vendor's library for this. I generate dynamic queries, sometimes with many ...
4
votes
1answer
3k views

Using POST data to call a function from a specified class

I've inherited a class in a project which is purposed to execute a function that exists in POST data from a specified class. I've tried to clean this up as much as possible as well as secure it ...
3
votes
4answers
252 views

SQL-injection mitigation script

I'll gladly appreciate it if you could review my code below and let me know if they are sufficiently secure. My main website and these scripts will use same database, so I need to make sure they are ...
-1
votes
2answers
229 views

Search for a transaction

Could you have a quick look over my code to see if it's safe from SQL injection etc.. and suggest any amendments? ...
3
votes
2answers
435 views

Confirming safety of SQL injection

I believe with everyone's help on Stack Overflow, I got my code safe guarded from SQL injection. I'm trying to confirm that is correct, just in case I misinterpreted the help and advice I received. <...
3
votes
1answer
3k views

Codeigniter active record

I understand that I should use prepared statements to prevent SQL injection. Unfortunately, having read the PHP docs on the matter I am none the wiser. Here is one of my simple active record SQL ...
4
votes
4answers
752 views

Adding entries to an MS Access file using OleDB

In the following piece of code I am adding entries to an MS Access file using OleDB. The purpose of this post is to point out my bad programming practices and if I have created any security flaws here....
5
votes
6answers
2k views

Using OLEDB to connect to a MS Access 2007 file

I am working on a program which use OLEDB to connect to a MS Access 2007 file. My program has a possibility to add and delete records from file by using SQL statements which select deleted item by ID. ...
2
votes
1answer
432 views

Simultaneously searching listings by attributes such as category, title, postcode

Is the code below safe from SQL injection? ...