3 ms·
I haven't seen any examples (just code snippets), but I wouldn't call all unsanitized queries SQL injection vulnerabilities: $sql = "SELECT * FROM inventor
by askmike 10y ago
I haven't seen any examples (just code snippets), but I wouldn't call all unsanitized queries SQL injection vulnerabilities:
$sql = "SELECT * FROM inventory_item WHERE product_category_id='$pcid'";
The pcid var might have been checked/cleaned up before this line (might even be part of the same SO answer).
-----
Obviously that doesn't mean this is very bad practise, especially at stackoverflow where you know people will just copy and paste your code.
- vomitcuddle 10y agoyeah, unless the snippet also includes a definition for variable $pcid, there is no proof that the code is actually vulnerable - using such simplistic logic, the stats are likely hugely inflated but i don't agree that it should be the poster's responsibility to show their sanitation logic to prevent people from blindly copying-and-pasting their code, if it's not relevant to their question