Do you consider security when designing your query string parameters for a website?

Question

if you have a website's page named 'test' that has the following code:

[ASP.NET]

sCid = Request.QueryString["cid"] as string;

sQry = "SELECT * FROM [MyTable] WHERE id=" + sCid + " ORDER BY id";

or [PHP]

$cid = $_GET["cid"];

$qry = 'SELECT * FROM [MyTable] WHERE id=' . $cid . ' ORDER BY id';

What do you think will be the result of executing the query if I passed in the URL

/test?cid=1 UNION SELECT NULL FROM INFORMATION_SCHEMA.TABLES

Ahmad El-Agawy · Answer

Mentioned logic is far away from security, because of SQL injection possibility you referred to.so, my advice is to never use concatenation in SQL queries ex. "select * from table where id =" + idVar; because it's so easy to pass another SQL query injected, instead you need to use body variables / stored procedures. ex. "select * from table where id = @id", after you set the value of @id parameter.

خدمات بيت.كوم

استخدم تطبيق بيت.كوم

ابدأ بالتواصل مع الأشخاص وتبادل معارفك المهنية

Do you consider security when designing your query string parameters for a website?

عمليات البحث الشائعة

المزيد من الأسئلة المماثلة