The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
57 views

Is this type of data insertion safe and can stop sql injection in Python?

I am learning Database connection from MySQL Connector/Python Developer Guide. This is the code I am using to insert data: conn = mysql.connector.connect(user="user", password="password", ...
1
vote
4answers
377 views

Database Handler and SQL injection prevention

I've written a database model class in PHP and have written a controller class that specifically validates the data before sending it to db. I'm getting criticism that I should handle the data in ...
2
votes
1answer
206 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
0
votes
2answers
827 views

Is my application vulnerable to SQL injection if I don't specify each type in Doctrine2?

I thought Doctrine 2 DBAL prepared statements were safe from SQLi. But I found this confusing bit in the docs: By default the Doctrine DBAL does no escaping. Escaping is a very tricky business ...
5
votes
1answer
409 views

Is there a database programming language with encapsulation to prevent the injections?

One of things that annoys me about SQL is that it can't think in terms of objects and it's lack of encapsulation makes me constantly have to escape commands to prevent injections. I want a database ...
6
votes
5answers
673 views

Are SQL Injection vulnerabilities in a PHP application acceptable if mod_security is enabled?

I've been asked to audit a PHP application. No framework, no router, no model. Pure PHP. Few shared functions. HTML, CSS, and JS all mixed together. I've discovered numerous places where SQL injection ...
12
votes
3answers
752 views

Is reliance on parametrized queries the only way to protect against SQL injection?

All I have seen on SQL injection attacks seems to suggest that parametrized queries, particularly ones in stored procedures, are the only way to protect against such attacks. While I was working (back ...
1
vote
2answers
826 views

SQL injection attacks, how do I test and secure coldfusion queries?

I'm running Coldfusion 8 and SQL server 2008. I've been building serveral forms that insert data into the database from external users, we have a custom built security module built by the guy who ...
15
votes
6answers
671 views

Discovered large security hole in someone elses website… What to do? [duplicate]

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users. I went to have a look at it to see what ...