36 votes
Accepted

Inserting robot moves into an SQLite3 database

Just a philosophical answer here. I think you're asking the wrong question. You shouldn't ask yourself "is my SQL code safe or vulnerable?" This is too hard to answer in any individual case, and ...
machine yearning's user avatar
18 votes

Inserting robot moves into an SQLite3 database

Your code is vulnerable to SQL injection! Use something like this to prevent it: ...
Grajdeanu Alex's user avatar
16 votes
Accepted

Inserting OAuth data into a database

I don't know that my code is vulnerable to SQL injection. Yes, it is. You should never put any variables directly into SQL statements. Even if you think that the variables may possibly be safe, it'...
tim's user avatar
  • 25.1k
13 votes

Inserting robot moves into an SQLite3 database

There's no way for us tell, from reading this fragment of code, whether there is a SQL injection problem. On the one hand, the query is constructed using string interpolation, which is risky, but the ...
Gareth Rees's user avatar
  • 49.6k
7 votes

Inserting a record into MySQL with a timestamp

Security SQL Injection It's probably[*] secure, but it's not the right way to do it, see for example here why prepared statements are better than escaping. Sooner or later, you will mess up when ...
tim's user avatar
  • 25.1k
7 votes

Stored procedure to query custom data tables as dynamic SQL

Does this open the door to destructive injection attacks? It depends, but potentially, yes it can, especially with dynamic SQL, which you should try to avoid unless it is absolutely necessary. You ...
Phrancis's user avatar
  • 20.4k
5 votes
Accepted

PHP login script

There is one logical inconsistency and two security issues. All other improvements will be just removal of useless or misplaced code. User not found case. If a user makes a typo in the username, ...
Your Common Sense's user avatar
5 votes
Accepted

Email subscription queries for a PHP website

If you are using the mysqli functions, then do not call mysql_real_escape_string(), which is part of the deprecated mysql suite of functions. At the least, you ...
200_success's user avatar
5 votes

Safe dynamic SQL for generic search

Comments on your approach The most obvious thing to me is that you're already inserting all of your data into the temp table; why not just join to it? You can dynamically pivot into a better, ...
Dan Oberlam's user avatar
  • 7,804
5 votes
Accepted

Does this PDO process look protected from SQL injection?

It looks like your script is part of a basic ajax searching technique. $_POST is typically used when writing to the database (or when there is a distinct reason ...
mickmackusa's user avatar
  • 8,644
5 votes
Accepted

Email Validation in PHP

First and foremost, regardless of any real or imaginary security issue, this code is a pain in the eye. It's nearly impossible to get the gist of it and to answer the actual question because the code ...
Your Common Sense's user avatar
5 votes
Accepted

Sanitizing user form input in php

I am concerned that you are not digesting the advice given in previous reviews, because you are ONLY to call htmlspecialchars() just before you print to an html ...
mickmackusa's user avatar
  • 8,644
4 votes

Inserting OAuth data into a database

Yes, your code is perfect to practice SQL injection. Any basic example may be used. You picked the 100% procedural version and I can't see a single ...
Ismael Miguel's user avatar
4 votes
Accepted

PHP Dynamic QueryBuilder function - Security

Security and Readability So here I assume that the user cannot maliciously enter their own input (I may be wrong, please correct me if so). Yes, you are wrong about that. ...
tim's user avatar
  • 25.1k
4 votes
Accepted

Possibility of SQL Injection

SQL Injection Am I opening myself up to SQL Injection with the current way I am building the SQL? Yes, you are very likely open to SQL injection. Here are code pieces that look vulnerable: <...
tim's user avatar
  • 25.1k
4 votes

Booking appointments with MySQLi and PHP

Code has to be readable if(isset($_POST['slots_booked'])) $slots_booked = mysqli_real_escape_string($link, $_POST['slots_booked']); Going through this code I ...
xReprisal's user avatar
  • 331
4 votes
Accepted

Database Model Security For Book Inventory

Anytime I see something like these I wonder "is there a better way we can do this?": ...
Der Kommissar's user avatar
4 votes

Email Validation in PHP

Unnecessary information disclosure Don't do this: $headers .= "X-Mailer: PHP". phpversion() ."\r\n" ; This will show up in the mail headers and ...
Kate's user avatar
  • 6,510
4 votes
Accepted

Follow up to Validation Script in PHP

First query looks good. any more improvements I don't understand why you're even asking the question. What part of Sam's "use bound variables" answer was unclear? We start out with ...
J_H's user avatar
  • 25k
3 votes
Accepted

Prepared statements in PHP

Non-review answers what security threats this script can prevent - sql injection what security threats this script is vulnerable to - sql injection how these threats are blocked - https://...
Your Common Sense's user avatar
3 votes

User authentication SQL injection

Strictly speaking, we cannot tell whether your code is safe or not, because you are using some homemade solution for the database interaction. From the way it is used, we could assume that it's safe, ...
Your Common Sense's user avatar
3 votes

User authentication SQL injection

First, regarding your initial question: the code you have right here is definitely safe against SQL injection. Using prepared queries (which you are doing) will protect you from the majority of SQL ...
Conor Mancone's user avatar
3 votes
Accepted

Function for inserting data into database

My suggestion is to simply abandon this piece of code. I don't know what value that it is adding. Trying to create some super flexible function that can query any table in any manner is just adding ...
Mike Brant's user avatar
  • 9,608
3 votes

Inserting robot moves into an SQLite3 database

Given the restrictions that you can't change your database structure (and as Gareth Rees points out, that would be better), the way I would resolve this is using an Enum or Class. Basically, while you ...
deworde's user avatar
  • 131
3 votes

Creating ADODB Parameters on the fly

Waking this one up... ExecuteNonQuery Return value never assigned ExecuteNonQuery never has its return value assigned. Return value type You have an ...
ThunderFrame's user avatar
  • 1,959
3 votes

Inserting OAuth data into a database

I can also add something, You can use UPDATE ON DUPLICATE KEY to prevent 1 extra query. To do that you will need to use a unique column to check the duplication.
Ozan Kurt's user avatar
  • 166
3 votes
Accepted

Inserting a record into a MySQL table using PDO

No, it's not vulnerable to SQL Injection, as you use prepared statements, and you use them correctly. If you don't have any CSRF protection it is however vulnerable to XSS because of the echo (and of ...
tim's user avatar
  • 25.1k
3 votes

storing data about available RPG games

I don't know why you call keys of the $_POST Array "static" (and what does it mean at all) but the article you linked to (which I wrote) explicitly demonstrates that $_POST Array keys are unsafe and ...
Your Common Sense's user avatar
3 votes

Database Model Security For Book Inventory

...
t3chb0t's user avatar
  • 44.3k
3 votes
Accepted

PHP MySQLi Prepared Statements: Can this select query be hacked/injected?

Given an answer on Stack Overflow suggests almost identical code for protection, let alone using exactly the same principle you can safely assume that your query is protected. If you want to know ...
Your Common Sense's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible