How to determine if a user tried to attack with SQL injection

Question

I am familiar with using functions mysql_real_escape_string()and PHP FILTER_SANITIZEto prevent sql injections.

However, I am curious how I would define in a PHP script if user input was a likely attempt at SQL injection? This would be useful for tracking potentially malicious IP addresses.

Answer 1

If the output mysql_real_escape_stringis different from the input, then the input contains unsafe characters. You might conclude that the user may have tried to attack, especially if the field in question is one where you usually expect a small number of insecure characters (such as a zip code).

But this may be because their name turned out to be Robert'); DROP TABLE Students; --.

Thus, in general, there is no way to do this, even close to reliable.

Answer 2

The simple answer is: you cannot. Just write a code that suggests that the pitch will get hit, then you won’t be mistaken.

Answer 3

, , SQL- ( ).

, , , GreenSQL DB Networks ADF-4200, , , "".

whitelisting , . , , . , whitelisting, , .

- mod_security, , whitelisting .

, , ( ) .

Answer 4

'-' ';' ... , OR, AND, ( .. 100% , .

Answer 5

, , - , , , , .

Answer 6

!

!

sql , ( ) :

union
select
drop
--
; 

, SQL-, , . , , , , , ! - .

Answer 7

:

• , , .
• .
• (, mysql - (?)).
• , .

, , .

Answer 8

(union, delete, drop, ...) . --, \n ( ), , . , - - .

(, , , ...), .

Answer 9

( )

EDIT. :

• , , .
• .
• (, mysql - (?)).
• , .

But in this way, you can detect potentially successful attack attempts, and not those that give a parsing error.