Is this query vulnerable to SQL Injection attacks

Question

I have been given a project to complete, in the backend there are SQL statements doing various things, as you'd expect.

In the past I have used PDO to construct SQL queries that use parameterisation to avoid injection attacks.

Whilst reading through the code I noticed many queries in the form of:

$sql = "SELECT * FROM detail WHERE email ='$email'";
$query = mysqli_query($dbcon, $sql);

With no parameterisation or cleaning of input.

Is this type of query vulnerable, should there not be some form of parameterisation and more importantly should I explain the risks involved as it seems the developer was unaware of the risk.

*Is this type of query vulnerable* Yes, *should there not be some form of parameterisation?* Yes. But you can achive it with mysqli. you must not Change to PDO — Jens, Aug 16 '17 at 12:28
You can achieve what you want with mysqli, but IMHO, PDO is easier to use than `MySQLi_*` — GrumpyCrouton, Aug 16 '17 at 12:50

score 2 · Accepted Answer · edited Aug 16 '17 at 12:55

2

Yes it is,

But you can use this with mysqli : http://php.net/manual/en/mysqli.prepare.php

So with your data it will be like :

$prepare = $dbcon->prepare("SELECT * FROM detail WHERE email = ?");
$prepare->bind_param("s", $email);
$prepare->execute();

edited Aug 16 '17 at 12:55

Funk Forty Niner

74,372
15
66
132

answered Aug 16 '17 at 12:29

Thibault Dumas

922
2
8
19

1

Theoretically correct, but link only answers are not particularly well-taken, and using a French reference which is something should be changed to the English equivalent of that link. There should contain a minimal example on its usage in the answer. – Funk Forty Niner Aug 16 '17 at 12:34
Yep, just edited my answer – Thibault Dumas Aug 16 '17 at 12:40
Looking good, *cheers* – Funk Forty Niner Aug 16 '17 at 12:43
Actually, you made a syntax error. [`bind_param()`](http://php.net/manual/en/mysqli-stmt.bind-param.php) uses an `s` for a string, and not `email`. I edited your answer. – Funk Forty Niner Aug 16 '17 at 12:55
Oups i mingled with PDO syntax, my bad, thanks – Thibault Dumas Aug 16 '17 at 12:57

Is this query vulnerable to SQL Injection attacks

1 Answers1