Is SQL injection a risk today?

Asked 2009-11-05T21:40:56.020

I've been reading about SQL injection attacks and how to avoid them, although I can never seem to make the "awful" examples given work, e.g. see this post.

I created a PHP file and a table in the database, had a value passed through $_GET and tried to delete the table by doing bob'); drop table students; -- and it didn't work. PHP automatically escapes the \' and the query has an error, no harm done. Same issue when trying to replicate login "attacks" like AND WHERE 1=1 etc.

example code:

<?php
$id = $_GET['id'];

$sql = "INSERT INTO Users (Username) VALUES ($id)";
echo $sql;
mysql_query($sql) or die(mysql_error());

And I'd pass sql.php?id=1); delete from Users; --

So is this some dated thing that used to apply in the days of PHP3 or something, and nowadays even novices are protected from things like magic quotes?

I'm using PHP5 on Ubuntu.

php sql sql-injection

Edit Report

2 Answers

Parameters passed to sql queries from the web pages ofen tend to be numeric IDs. For example let's assume you have an url http://foo.com/page.php?section=34 from which the section ID is used in a query like this:

SELECT content FROM sections WHERE section_id=$section;

No quotes to escape like in your example and whatever you'll put after the number in the URL will be passed to the query... So thew risk is real.

answered 2009-11-05T21:48:58.937

Whenever building up SQL from strings, SQL injection is a real danger.

I have also discovered that trying to avoid building up SQL from strings is a pointless endeavor. Sooner or later the full form of your SQL (not just things that could be parameters) must be generated at runtime.

answered 2009-11-07T20:42:17.950

Is SQL injection a risk today?

2 Answers

Your Answer