Is this query vulnerable to SQL injection?

Question

$myq = sprintf("select user from table where user='%s'", $_POST["user"]);

I would like to know if the query described above can be used with SQL injection. Is there any advanced SQL injection technology that could break sprintffor this particular query?

Answer 1

I don't think this should be particularly advanced ... try typing

' OR 1 = 1 OR user='

In other words, you get SQL:

select user from table where user='' OR 1 = 1 OR user=''

Does this look like a query that you really want to fulfill? (Now consider the possibility of deleting tables instead, or something similar.)

The bottom line is that you should use a parameterized query.

Answer 2

sprintf , . sprintf , , PHP. sprintf , %s:

$str = implode('', range("\x00", "\xFF"));        // string of characters from 0x00 – 0xFF
var_dump(sprintf("'%s'", $str) === "'".$str."'"); // true

, , ( MySQL, , youre MySQL), **mysql_real_escape_string**:

$myq = sprintf("select user from table where user='%s'", mysql_real_escape_string($_POST["user"]));

Answer 3

, , :)

: \x00, \n, \r, \, ', " \x1a. sprintf() , sprintf() , , .

ARE , , - magic quotes ( Rob ), sprintf(). , .

Answer 4

$_POST [ "user" ] "'; SHUTDOWN;" - ?

Answer 5

, !:)
magic quotes !

, magic_quotes_gpc ini off mysql_real_escape_string, .

Answer 6

, .

PHP, , :

$inUser = $_POST['user'];
$outUser = filter_var($inUser, FILTER_SANITIZE_STRING);

HTML- .

, :

$inUser = $_POST['user'];
$outUser = mysqli_real_escape_string($conn, $inUser);

MySQL, , ..

, :

$sql = "SELECT user FROM table WHERE user = ?";
$stmt = $pdo->prepare($sql);
$params = array($outUser);
$stmt->execute($params);

.. , SQL-.

.

Answer 7

$_POST["user"] = "' or 1=1 or user='"

Answer 8

.

- :

'; delete * from table