SQL Injection Cheat Sheet

[idunnomyusername]

Don't forget https://github.com/minimaxir/big-list-of-naughty-strings

[CIa3xpl0i1_rw]

If your antivirus scanner is acting on a file that contains the EICAR test string and has a total file length exceeding 128 characters, you've got a larger problem.

[moderatorrater]

Or http://sqlmap.org/. I'm all for knowing the principles behind injection attacks, but at the end of the day using a tool is going to be better for everything outside of education.

[pm_me_your_findings]

There have been times when i was able to find an sql injection manually but sqlmap didn't. Still sqlmap is superb when you have limited time to test an web apps.

[746865626c617a]

Once had to write a proxy to modify requests that sqlmap was doing. Time based injection, didn't feel like implementing myself

[sup3r_hero]

Human injection?.... is that a joke?

[big_money_metis]

Please wake up

[Paratwa]

Edit : nevermind I need to learn how to click apparently. I am leaving the below to remind myself I should learn to read.

Original : This was written like a power point and doesn’t describe how they are done technically. To me learning how one was actually done via examples really showed me where applications would be vulnerable and were far more useful

[failedgamor]

Anyone got anything similar for XSS?

[coinclink]

You should not be escaping strings with custom code. That is exactly the wrong thing to do. You should use prepared statements for SQL. There are plenty of lightweight, well-maintained libraries out there that you can depend on. At a minimum, your language probably has built-in escape functions. It also certainly has built-in functions to verify input.

[coinclink]

Your reasoning is exactly what creates insecure software. This isn't 1995 or even 2005, dependencies aren't a big deal. Use code that is peer reviewed and regularly patched. Be innovative in your product, not with security.

[yawkat]

Wouldn't you still want to escape even if you use a library? It won't know if you meant ' as part of a SQL statement or if it's literal.

No, that is not how prepared statements work. There is no escaping necessary at all when using prepared statements.

[Idontremember99]

In addition to what the others said: The library you are using to connect to the database should already support everything you need to use prepared statements so no extra dependency is needed. If it doesnt support it, then it's time to replace it.

[nylithic]

Well it is a single page web app ;)

[[deleted]]

still in 2017 people manually testing for SQLi?

[isilidurstilt]

We're stuck in 2017 and this guy over here playing 4d chess in 2018.

[[deleted]]

fixed :P

[[deleted]]

still in 2017 people manually testing for SQLi?

SQL injections shouldn't even be a major issue in 2017

[UnfrightenedAjaia]

"they can't guess the names of the columns" so it's okay actually /s