Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to databases and security.

I am planning to put up a website.

I've read that sql-injection vulnerabilities can be very dangerous since the server might leak user passwords and credit-card information.

Are there any steps that I need to follow to prevent SQL injection vulnerabilities?

I was going through a wiki on sql-injection, but I didn't understood the following query:

SELECT * FROM users WHERE name = '" + userName + "';
share|improve this question
You may want to add more information about what you don't understand about the query. Is it the double-quotes you don't understand, or the entire query? If you are new to databases and security, and are concerned about SQL injection vulnerabilities, you would do well to take a course, or better yet, hire a professional. SQL Injection is a very complex topic and not easily covered in a simple question and answer format such as this. – Max Vernon Sep 27 '12 at 2:45
If you are worried about leaking credit card information, you really, really need to hire a security and database professional. – Max Vernon Sep 27 '12 at 2:46
@MaxVernon, it's the combination of the single quote and the double quote that is confusing me and the '+'. – Ankit Sep 27 '12 at 5:57
The double-quotes prevent escaping from the intended query by using a single quote embedded within the userName variable. Consider what would happen if userName was filled in by the user as: ';DROP TABLE users + ' - this would have the unfortunate side effect of deleting the Users table, with no warning, and no way of preventing it. The double-quotes encapsulate the bad query, essentially forcing it to be evaluated as part of the WHERE clause. – Max Vernon Sep 27 '12 at 6:02

you better use prepared statement from your programming source code, e.g. for PHP use PDO's prepare statement!

Check this -

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.