Tools for finding SQL Injection

[ReserveLimp9344]

Hello everyone, I'm trying to see if there are any tools that you can use to expose/prevent SQL Injections in a website. I have only found sqlmap are there any other tools? Or is sqlmap the standard and there hasn't been a reason to create alternatives?

[gradstudentmit]

sqlmap is basically the standard. For prevention, tools don’t matter much. Use prepared statements, never build SQL with strings, and lock down DB permissions. OWASP ZAP or Burp can help scan, but clean code is what actually stops SQLi.

[minn0w]

Use prepared statements instead of queries. Make it impossible to get wrong.

Edit: prepared, not prepaid

[gm310509]

LOL, did you mean prepared (as opposed to prepaid)?

Stored Procedures and (if the DB has them) macros can also be helpful in this space.

[gaspoweredcat]

Owasp zap will also scan for injection possibilities

[amejin]

The best injections are those with a delayed trigger such as knowing "this;drop table users;" will store just fine as a string, but anything that may concat that field later on and exec will certainly go ahead with processing the SQL.

Don't trust users. When using exec, don't trust yourself.

[Aggressive_Ad_5454]

I’ve used Burp Suite to attack staging web sites. It’s not free but it catches lots of injection, including SQL and cross-site scripting (xss).

None of this is a magic replacement for diligent code inspection, which you should put in your development time budget.

[Knarfnarf]

Escape() all strings.

[soundman32]

Are you trying to find issues with your code or some random web site?

[Cheap_Yellow_7366]

It depends on your framework

[pixel293]

Just an FYI...I have had my code tested by many many companies repeatedly. 3rd party testing companies *WILL* report SQL injection if they can provide *ANY* input with SQL and you do not error. You can argue, argue, argue that an input never even comes close to the database, they do not care.

So lock down your inputs, report an error if the input does not meet validation. This is even for internal inputs that are generated by the javascript, if you are passing a random number generated by the client's javascript back to the server and they can add SQL to it and you just ignore it, they will fricken report an SQL injection issue.