+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: SQL Injection vulnerable ? (/showthread.php?tid=6066887)
SQL Injection vulnerable ? - rebug - Apr 14, 2020
I would like your opinion on this method to avoid any sql injection :
My request to database is always like this:
PHP Code
<?php
$request = odbc_exec($mssql, 'SELECT COUNT(*) as count FROM [%NAME%] WHERE %value%=\''.mssql_escape_string($_GET['%GETPARAM%']).'\'');
My function mssql escape string :
PHP Code
<?php
function mssql_escape_string($string) {
$replaced_string = str_replace("'", "''", $string);
return $replaced_string;
}
Thx
RE: SQL Injection vulnerable ? - Snickerson - Apr 19, 2020
Look into prepared statements. php.net/manual/en/mysqli.quickstart.prepared-statements.php
RE: SQL Injection vulnerable ? - ApertureSecurity - Apr 24, 2020
Prepared statements are NOT always enough.
https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php