Page 1 of 1

MySQL Injection.

Posted: Wed Oct 26, 2011 10:43 am
by mikeashfield
I've only just heard about this today. How can I see if my PHP code is injectable? I know now about using mysql_real_escape_string so will get all that sorted.

Re: MySQL Injection.

Posted: Wed Oct 26, 2011 8:56 pm
by Celauran
mikeashfield wrote:I know now about using mysql_real_escape_string so will get all that sorted.
Better still, use prepared statements.

Re: MySQL Injection.

Posted: Thu Oct 27, 2011 1:25 am
by social_experiment
mikeashfield wrote:How can I see if my PHP code is injectable?
PM Mordred
Security consulting

Re: MySQL Injection.

Posted: Thu Oct 27, 2011 2:30 am
by Mordred
Or, you know, see if you can find a forum about PHP/security and try posting your code there :)

If you've read a basic tutorial on sql injection, you can also try my article (link in the sig, but the HTML version is broken, so use the plaintext one: http://www.webappsec.org/projects/articles/091007.txt)
There's a link to a zip file inside with all the demo code in the article which you can tweak and use as a playground.

Re: MySQL Injection.

Posted: Thu Oct 27, 2011 12:59 pm
by Eric!
Also there are some tools for sql injection testing using metasploit framework. But you should really hire Mordred to test it out properly.

Re: MySQL Injection.

Posted: Fri Oct 28, 2011 11:49 pm
by uday8486
You can check whether your form accepts sql keywords, special characters like " ' " etc. Also some times the injection is done using encoded string which might be a sql query. Also Google on types of SQL injections

Re: MySQL Injection.

Posted: Sat Oct 29, 2011 1:28 am
by jaustin
Understand the problem - then use a framework.

Re: MySQL Injection.

Posted: Sat Oct 29, 2011 4:55 am
by social_experiment
uday8486 wrote:You can check whether your form accepts sql keywords, special characters like " ' " etc.
It's probably easier to use mysql_real_escape_string().