skdx: SQL Injection

Showing posts with label SQL Injection. Show all posts

What is IP address?

What is IP address?

What is IP address? An IP address, or simply an "IP," is a unique address that identifies a device on the Internet or a local netw...

8:01 AM

Acunetix Release Web Site Security Pen Testing Tools Free

Acunetix Release Web Site Security Pen Testing Tools Free

Acunetix Release Web Site Security Pen Testing Tools Free HTTP editor, fuzzer and sniffer tools help pen testers identify vulnerabilities Lo...

6:01 PM

What is SQL Injection and How to Prevent It use Guidelines A-Z Part 1

<header class="entry-header" style="background-color: white; box-sizing: border-box; color: #333333; font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 30px; margin: 20px 0px; outline: 0px !important; padding-bottom: 0px; padding-top: 8px;"><h1 class="entry-title" style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 24px; height: auto; line-height: 1.1; margin: 0px 0px 10px; outline: 0px !important; overflow: visible; text-overflow: clip;">What is SQL Injection (SQLi) and How to Prevent It</h1></header><div class="entry-content" style="background-color: white; box-sizing: border-box; color: #333333; font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; outline: 0px !important;"><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">SQL Injection (SQLi) is a type of an <a href="https://www.acunetix.com/blog/articles/injection-attacks/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">injection attack</a> that makes it possible to execute malicious SQL statements. These statements control a database server behind a web application. Attackers can use SQL Injection vulnerabilities to bypass application security measures. They can go around authentication and authorization of a web page or web application and retrieve the content of the entire SQL database. They can also use SQL Injection to add, modify, and delete records in the database.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">An SQL Injection vulnerability may affect any website or web application that uses an SQL database such as MySQL, Oracle, SQL Server, or others. Criminals may use it to gain unauthorized access to your sensitive data: customer information, personal data, trade secrets, intellectual property, and more. SQL Injection attacks are one of the oldest, most prevalent, and most dangerous web application vulnerabilities. The OWASP organization (Open Web Application Security Project) lists injections in their <a href="https://www.acunetix.com/vulnerability-scanner/owasp-top-10-compliance/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">OWASP Top 10</a> 2017 document as the number one threat to web application security.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;"><img alt="SQL Injection" class="alignnone size-large wp-image-18541" height="555" sizes="(max-width: 910px) 100vw, 910px" src="https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-1024x624.jpg" srcset="https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-1024x624.jpg 1024w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-300x183.jpg 300w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-768x468.jpg 768w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-910x554.jpg 910w, https://www.acunetix.com/wp-content/uploads/2019/02/SQL-Injection-100x61.jpg 100w" style="border-radius: 4px; border: 0px; box-sizing: border-box; height: auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="910" /></div><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;">How and Why Is an SQL Injection Attack Performed</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">To make an SQL Injection attack, an attacker must first find vulnerable user inputs within the web page or web application. A web page or web application that has an SQL Injection vulnerability uses such user input directly in an SQL query. The attacker can create input content. Such content is often called a malicious payload and is the key part of the attack. After the attacker sends this content, malicious SQL commands are executed in the database.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">SQL is a query language that was designed to manage data stored in relational databases. You can use it to access, modify, and delete data. Many web applications and websites store all the data in SQL databases. In some cases, you can also use SQL commands to run operating system commands. Therefore, a successful SQL Injection attack can have very serious consequences.</div><ul style="box-sizing: border-box; margin-bottom: 10px; margin-top: 0px; outline: 0px !important; padding-left: 20px;"><li style="box-sizing: border-box; outline: 0px !important;">Attackers can use SQL Injections to find the credentials of other users in the database. They can then impersonate these users. The impersonated user may be a database administrator with all database privileges.</li><li style="box-sizing: border-box; outline: 0px !important;">SQL lets you select and output data from the database. An SQL Injection vulnerability could allow the attacker to gain complete access to all data in a database server.</li><li style="box-sizing: border-box; outline: 0px !important;">SQL also lets you alter data in a database and add new data. For example, in a financial application, an attacker could use SQL Injection to alter balances, void transactions, or transfer money to their account.</li><li style="box-sizing: border-box; outline: 0px !important;">You can use SQL to delete records from a database, even drop tables. Even if the administrator makes database backups, deletion of data could affect application availability until the database is restored. Also, backups may not cover the most recent data.</li><li style="box-sizing: border-box; outline: 0px !important;">In some database servers, you can access the operating system using the database server. This may be intentional or accidental. In such case, an attacker could use an SQL Injection as the initial vector and then attack the internal network behind a firewall.</li></ul><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">There are several types of SQL Injection attacks: in-band SQLi (using database errors or UNION commands), blind SQLi, and out-of-band SQLi. You can read more about them in the following articles: <a href="https://www.acunetix.com/websitesecurity/sql-injection2/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Types of SQL Injection (SQLi)</a>, <a href="https://www.acunetix.com/websitesecurity/blind-sql-injection/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Blind SQL Injection: What is it</a>.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">To follow step-by-step how an SQL Injection attack is performed and what serious consequences it may have, see: <a href="https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Exploiting SQL Injection: a Hands-on Example</a>.</div><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;">Simple SQL Injection Example</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The first example is very simple. It shows, how an attacker can use an SQL Injection vulnerability to go around application security and authenticate as the administrator.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following script is pseudocode executed on a web server. It is a simple example of authenticating with a username and a password. The example database has a table named <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">users</code> with the following columns: <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">username</code> and <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">password</code>.</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;"># Define POST variables<br /><span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">uname = request.POST['username']</span><br /><span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">passwd = request.POST['password']</span><br /><br /># SQL query vulnerable to SQLi<br />sql = “SELECT id FROM users WHERE username=’” + <span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">uname</span> + “’ AND password=’” + <span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">passwd</span> + “’”<br /><br /># Execute the SQL statement<br />database.execute(sql)</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">These input fields are vulnerable to SQL Injection. An attacker could use SQL commands in the input in a way that would alter the SQL statement executed by the database server. For example, they could use a trick involving a single quote and set the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">passwd</code> field to:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">password' OR 1=1</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">As a result, the database server runs the following SQL query:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">SELECT id FROM users WHERE username='username' AND password=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">'password' OR 1=1</span>'</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">Because of the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">OR 1=1</code> statement, the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">WHERE</code> clause returns the first <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">id</code> from the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">users</code> table no matter what the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">username</code> and <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">password</code> are. The first user <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">id</code> in a database is very often the administrator. In this way, the attacker not only bypasses authentication but also gains administrator privileges. They can also comment out the rest of the SQL statement to control the execution of the SQL query further:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code class="nohighlight" style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">-- MySQL, MSSQL, Oracle, PostgreSQL, SQLite<br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">--</span><br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">/*</span><br />-- MySQL<br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">#</span><br />-- Access (using null characters)<br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;"></span><br />' OR '1'='1' <span style="box-sizing: border-box; color: #cc0000; font-weight: 700; outline: 0px !important;">%16</span></code></pre><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;">Example of a Union-Based SQL Injection</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">One of the most common types of SQL Injection uses the UNION operator. It allows the attacker to combine the results of two or more SELECT statements into a single result. The technique is called <em style="box-sizing: border-box; outline: 0px !important;">union</em>-based SQL Injection.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following is an example of this technique. It uses the web page <span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">testphp.vulnweb.com</span>, an intentionally vulnerable website hosted by Acunetix.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following HTTP request is a normal request that a legitimate user would send:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">GET http://testphp.vulnweb.com/artists.php?artist=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">1</span> HTTP/1.1<br />Host: testphp.vulnweb.com</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;"><img alt="HTTP request a legitimate user would send" class="size-full wp-image-15943 aligncenter" height="603" sizes="(max-width: 718px) 100vw, 718px" src="https://www.acunetix.com/wp-content/uploads/2012/10/image02.png" srcset="https://www.acunetix.com/wp-content/uploads/2012/10/image02.png 718w, https://www.acunetix.com/wp-content/uploads/2012/10/image02-300x252.png 300w, https://www.acunetix.com/wp-content/uploads/2012/10/image02-100x84.png 100w" style="border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="718" /></div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">artist</code> parameter is vulnerable to SQL Injection. The following payload modifies the query to look for an inexistent record. It sets the value in the URL query string to <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">-1</code>. Of course, it could be any other value that does not exist in the database. However, a negative value is a good guess because an identifier in a database is rarely a negative number.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">In SQL Injection, the <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; color: #c7254e; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 12.6px; outline: 0px !important; padding: 2px 4px;">UNION</code> operator is commonly used to attach a malicious SQL query to the original query intended to be run by the web application. The result of the injected query will be joined with the result of the original query. This allows the attacker to obtain column values from other tables.</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">GET http://testphp.vulnweb.com/artists.php?artist=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">-1 UNION SELECT 1, 2, 3</span> HTTP/1.1<br />Host: testphp.vulnweb.com</code></pre><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;"><img alt="SQL injection using the UNION operator" class="size-full wp-image-15941 aligncenter" height="603" sizes="(max-width: 718px) 100vw, 718px" src="https://www.acunetix.com/wp-content/uploads/2012/10/image00.png" srcset="https://www.acunetix.com/wp-content/uploads/2012/10/image00.png 718w, https://www.acunetix.com/wp-content/uploads/2012/10/image00-300x252.png 300w, https://www.acunetix.com/wp-content/uploads/2012/10/image00-100x84.png 100w" style="border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="718" /></div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The following example shows how an SQL Injection payload could be used to obtain more meaningful data from this intentionally vulnerable site:</div><pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; outline: 0px !important; overflow-wrap: break-word; overflow: auto; padding: 10px; word-break: break-all;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; font-size: inherit; outline: 0px !important; padding: 0px; white-space: pre-wrap;">GET http://testphp.vulnweb.com/artists.php?artist=<span style="box-sizing: border-box; font-weight: 700; outline: 0px !important;">-1 UNION SELECT 1,pass,cc FROM users WHERE uname='test'</span> HTTP/1.1<br />Host: testphp.vulnweb.com</code></pre><h2 style="box-sizing: border-box; color: inherit; font-family: inherit; font-size: 21px; font-weight: 400; line-height: 1.1; margin-bottom: 10px; margin-top: 20px; outline: 0px !important;"><img alt="SQL injection using the UNION operator with a FROM clause" class="size-full wp-image-15942 aligncenter" height="603" sizes="(max-width: 718px) 100vw, 718px" src="https://www.acunetix.com/wp-content/uploads/2012/10/image01.png" srcset="https://www.acunetix.com/wp-content/uploads/2012/10/image01.png 718w, https://www.acunetix.com/wp-content/uploads/2012/10/image01-300x252.png 300w, https://www.acunetix.com/wp-content/uploads/2012/10/image01-100x84.png 100w" style="border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; display: block; height: auto; margin: 0px auto; max-width: 100%; outline: 0px !important; vertical-align: middle;" width="718" /><br style="box-sizing: border-box; outline: 0px !important;" />How to Prevent an SQL Injection</h2><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">The only sure way to prevent SQL Injection attacks is input validation and parametrized queries including prepared statements. The application code should never use the input directly. The developer must sanitize all input, not only web form inputs such as login forms. They must remove potential malicious code elements such as single quotes. It is also a good idea to turn off the visibility of database errors on your production sites. Database errors can be used with SQL Injection to gain information about your database.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">If you discover an SQL Injection vulnerability, for example using an Acunetix scan, you may be unable to fix it immediately. For example, the vulnerability may be in open source code. In such cases, you can use a web application firewall to sanitize your input temporarily.</div><div style="box-sizing: border-box; margin-bottom: 10px; outline: 0px !important; text-align: justify;">To learn how to prevent SQL Injection attacks in the PHP language, see: <a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;">Preventing SQL Injection Vulnerabilities in PHP Applications and Fixing Them</a>. To find out how to do it in many other different programming languages, refer to the <a href="http://bobby-tables.com/" rel="noopener" style="background: 0px 0px; box-sizing: border-box; color: #e31e25; outline: 0px !important; text-decoration-line: none; transition: all 0.2s ease-in 0s;" target="_blank">Bobby Tables guide to preventing SQL Injection</a>.</div></div>

What is SQL Injection and How to Prevent It use Guidelines A-Z Part 1

What is SQL Injection (SQLi) and How to Prevent It SQL Injection (SQLi) is a type of an injection attack that makes it possible to execute...

5:50 PM

Search This Blog

Blog Archive

Labels

Report Abuse

Pages

About Me

What is IP address?

Acunetix Release Web Site Security Pen Testing Tools Free

What is SQL Injection and How to Prevent It use Guidelines A-Z Part 1