Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sql-injection]

For questions about SQL injection vulnerabilities.

0
votes
0answers
25 views

I have created a website using SQL. I want to know whether my website is safe from the SQL injections or not?

The basic code which I used for the admin login and admin password is: </style> <div id="login-form"> <div> </div> <div > <h2 class="text-center">Login<...
-1
votes
1answer
144 views

Why most of Sql Injection need url like this “index.asp?id=123” [closed]

I am trying to learn "SQL Injection" concepts and also trying to practice some Kali tools to learn, but there is a question that I do not understand and my question is why do most tools need URL's ...
2
votes
2answers
73 views

PostgreSQL. Is using random tag in dollar quoting without escaping input safe?

Is that safe to run such query without escaping input? Assume noone can guess the random string I generate. SELECT * FROM foo WHERE bar = $long random tag$ THIS NOT ESCAPED $long random tag$ What ...
2
votes
0answers
77 views

Is using dollar quoting $$ and removing $ from input enough to avoid SQL injection in PostgreSQL?

I'm coding some logic in embeded Freeswitch LUA and built in database handling does not allow parametric input for SQL, so I need to escape the input. I'm sure my username should not have $ symbols ...
2
votes
1answer
69 views

Invoke-SqlCmd - does casting as integer prevent injection

I am lazy and would rather parameterize once (to get an object_id for a name) and use Invoke-SqlCmd for the rest of the work. Given a series of functions meant to work with an arbitrary server ...
2
votes
2answers
265 views

Safely quoting type names to protect against SQL-injection

How would I quote the type name to protect against SQL Injection. For example, take this SELECT FORMAT('SELECT CAST(%L AS %s);', '5.42', 'int'); ^ ...
3
votes
1answer
115 views

Does concating a string like this open me up to SQL injection?

I recently answered a question with the following code sample: Create Table #Testing ( emaildomain varchar(100) -- Still bigger than functionally needed but better than MAX ); INSERT INTO #Testing ...
2
votes
1answer
72 views

How to make PostreSQL functions private (inaccessible to end users)?

When writing a set of PostgreSQL functions with procedural languages, is it possible to make some of the supporting functions private and not accessible by end users? I wanted to refactor some common ...
3
votes
1answer
85 views

Is it efficient to use plpgsql functions only to validate identifiers and values?

Will my queries be safe from SQL injections if I use plpgsql functions only to validate identifiers and values, instead of executing queries. Here are the example functions: CREATE OR REPLACE ...
0
votes
0answers
272 views

SQL injection from text box

So I'm trying to attack a friend site for his discord server. He has setup a little page to set your name in his discord. The new name is set using a textbox in html Here is the request that he is ...
11
votes
1answer
986 views

What function quotes an identifier in dynamic-sql with SQL Server?

What is the SQL Server method of safe-quoting identifiers for dynamic sql generation. MySQL has quote_identifier PostgreSQL has quote_ident How do I ensure given a dynamically generated column name ...
5
votes
1answer
880 views

Microsoft SQL Server SQL Injection Through .NET Even With Quote Escaping [closed]

I've been reading up on SQL Injection as part of a security audit for a fairly large web service. I've been googling and read all the posts I could find here and on SO and have a fairly solid ...
1
vote
3answers
194 views

Is there a way to see if database has been accessed through SQL Injection attack?

I recently discovered that my website had a page with a SQL Injection vulnerability. Upon testing, it was easily exploitable with a pentesting tool like sqlmap. How do I figure out if the site ...
4
votes
2answers
1k views

Safe alternative to exec(sql)

I've found some exec(sql) statements buried in the code. They're there for good reason, because these statements couldn't be written directly, however they are an obvious attack vector. Is there a ...
-1
votes
1answer
99 views

Stop a person from entering my database and make changes [closed]

This one is probably very easy for most of you to answer and resolve, but not me... I could use some help and guidance. Someone had got access to my site, and now he keeps deleting tables from the ...
2
votes
0answers
93 views

JDBC Statement vs. Prepared Statement SQL Injection

as far as I understand a "normal" JDBC Statement which is created via conn.createStatement() is prone to SQL-Injection. A prepared statement protects from such attacks. So why/when should I use a ...
8
votes
1answer
2k views

Should we still be using QUOTENAME to protect from injection attacks?

I was looking at an old stored procedure today and noticed it was using quotename on the input parameters. After doing some digging to figure out what that does exactly I came across this site. I now ...
1
vote
1answer
3k views

Wildcard search using parameters in function with dynamic SQL

What is the proper way to implement a wildcard search in PostgreSQL when using a parameter in a function that uses dynamic SQL? As a starting point, here is an example from Erwin Brandstetter ...
7
votes
3answers
134 views

Find the source of a recurrent mass SQL edit on a server

I'll try to explain my problem as clear as possible. The server of a company I support runs many websites. This server runs Windows Server 2012 with Microsoft SQL Server 2014. Almost all of the ...
17
votes
2answers
3k views

Why does SQL Injection not happen on this query inside a stored procedure?

I made the following stored procedure: ALTER PROCEDURE usp_actorBirthdays (@nameString nvarchar(100), @actorgender nvarchar(100)) AS SELECT ActorDOB, ActorName FROM tblActor WHERE ActorName LIKE '%' ...
1
vote
1answer
842 views

Bringing SQL Server filegroups online

We've experienced an sql injection attack which corrupted our main db. The main db had two partitioned tables into filegroups. The corrupt database entered into Suspect mode, and it's been ...
1
vote
0answers
225 views

PostgreSQL DML statements

I am trying to trick an application into executing a DML statement AFTER starting a SELECT statement without using stacked queries so I cannot use the ; character anywhere in my query. I have resorted ...
0
votes
0answers
264 views

SQL Server DB in suspect mode after installing SQL Server 2008 R2 SP3

One of our production DBs is stuck in Suspect mode since we installed SQL Server 2008 R2 SP3. Earlier today we found that most text fields (nvarchar) had the following data appended to it </title&...
0
votes
1answer
1k views

Explain how this real injection attempt works [closed]

We use stored procedures and so far we haven't detected any injections that have been successful, but we see attempts all of the time. I started logging some of the data hoping to gain insight on ...
2
votes
1answer
499 views

Best Practice for Passing and Working With Parameters Security/Performance

Our senior programmer has been having me write stored procedures in the following format to protect against injection attacks. He says that the best practice is to take the parameter in, then declare ...
1
vote
1answer
469 views

Can we use TDE as an anti-injection technique

TDE prevent unauthorized access to the data by restoring the files to another server, because it requires the original encryption certificate and master key. If i applied a table level encryption ...
1
vote
2answers
1k views

Benefits of using prepared statements in stored procedures?

Except from helping avoid SQL injection, what are the benefits - if any - of using prepared statements inside a stored procedure (assume query is only executed once in the procedure)? Does the engine ...
1
vote
1answer
45 views

Could this ActiveRecord/SQL statement in my code base be susceptible to SQL injection?

I was reading up on SQL injection attacks from the Rails Guides and was wondering if the below line could be susceptible to a SQL Injection attack: accounts.where("lower(name) LIKE '%#{params[:query]....
0
votes
2answers
86 views

Searching a database safely using SELECT

I have a site that allows users to search the database for several items. However I am not that good with SQL and I have read that allowing user to type in boxes that then use "SELECT-statements" is ...
3
votes
2answers
1k views

SET ROLE via parameterized query

In the very helpful response I received to a previous question, I am trying to write some JDBC code that first sets the role to a specific user before executing subsequent queries. On the safe side I ...
1
vote
1answer
379 views

How to get more information from dm_exec_query_stats

I am running SQL server 2012 on windows azure VM (windows server 2012) I suspected that some of my web appliactions are attacked via SQL injection, So far i could not trace the relevant text with my ...
3
votes
3answers
408 views

Preventing SQL Injection

I know that this is very dangerous: EXEC sp_executesql 'SELECT * FROM ' + @Table But, is this safe from SQL injection? IF EXISTS(SELECT * FROM information_schema.tables WHERE TABLE_NAME = @Table) ...
0
votes
2answers
396 views

Are these linked server queries susceptible to SQL injection?

I'm using a stored procedure to generate a create table script on the fly based on parameters passed into it. I am validating that the server exists, and then validating if the table exists in the ...
1
vote
1answer
66 views

Am I using the ORDER BY clause incorrectly

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do ...
4
votes
3answers
648 views

How can I safeguard against SQL injection where parameterizing my query is not an option?

I'm working with ESRI's arcpy module, and I need to specify a WHERE clause as a parameter to this function. Since the result will eventually be used to retrieve data from the database, the text of the ...
-3
votes
1answer
2k views

error querying data with apostrophes [closed]

I'm getting empty sets from running the following query permutations: select * from gsapi_articles where article_title = "James Dean On Merilyn: 'This Woman Is A True Marvel'" select * from ...
3
votes
2answers
4k views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
27
votes
1answer
15k views

SQL injection in Postgres functions vs prepared queries

In Postgres, are prepared queries and user defined functions equivalent as a mechanism for guarding against SQL injection? Are there particular advantages in one approach over the other?
3
votes
3answers
1k views

Trace and analyze logs on SQL Server

I am using an SQL Server 2012 on windows datacenter 2012 I have encountered a situation where i think some virus/sql injection had heart my database, Some data on my table had changed to weird link'...
0
votes
1answer
936 views

Does this error message indicate a SQL injection vulnerability?

I just took over management for a webservice and today I got a user report about this error. Now I'm no sql injection expert but does this error make this attack possible? Microsoft OLE DB Provider ...
12
votes
3answers
2k views

Is there any way to break out of the string and inject SQL without using a single quote in oracle?

I'm testing an oracle based application and I've found the following code: Query = "SELECT name FROM employees WHERE id='"+PKID+"';" i.e. the query string contains quotes around the PKID value which ...
0
votes
2answers
2k views

How to protect MySQL database from sql-injection?

I am new to databases and security. I am planning to put up a website. I've read that sql-injection vulnerabilities can be very dangerous since the server might leak user passwords and credit-...
8
votes
2answers
9k views

Why you want to avoid Dynamic SQL in stored procedure?

I have heard one said you do not want to use Dynamic SQL. Can you give some concrete example or real-life example? Personally, I code it a few times in my database. I think it is OK because it's ...
14
votes
2answers
28k views

How can I insert smiley faces into MySQL ( 😊 )

I'm on MySQL 5.5.21, and trying to insert the '\xF0\x9F\x98\x8A' smiley face character. But for the life of me, I can't figure out how to do it. According to various forums which I've been reading, ...
0
votes
0answers
52 views

Database security through stored procedures [duplicate]

Possible Duplicate: Do stored procedures prevent SQL injection? I'm curious about some database security techniques I've been learning in class recently. Namely, I have implemented a SQL Server ...
8
votes
2answers
2k views

Should date formats be specified in SQL statements?

I see code from developers using implicit date conversion. I would like a definitive answer to why they should not do this. SELECT * from dba_objects WHERE Created >= '06-MAR-2012';
6
votes
4answers
3k views

Does putting single quotation marks around numeric constants really protect from SQL injection in MySQL?

The manual seems to suggest that using quotes around numbers is sufficient to protect from SQL injection. According to section 5.3.1. General Security Guidelines of the MySQL 5.1 Reference Manual: ...
6
votes
3answers
3k views

Building Dynamic SQL-Server Where Clause

Let us review this dba.exchange Oracle question for SQL-Server. This is SaUce's code, after a little formatting: CREATE PROCEDURE GetCustomer @FirstN nvarchar(20) = NULL, @LastN nvarchar(...
83
votes
6answers
10k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...