4 ms·
This is just not true. SQL injection attacks account for between 7-30% of web application attacks: https://www.esecurityplanet.com/network-security/most-common
by world32 8y ago
This is just not true. SQL injection attacks account for between 7-30% of web application attacks:
https://www.esecurityplanet.com/network-security/most-common-it-security-attack-not-sql-injection.html https://www.esecurityplanet.com/network-security/most-common...
https://www.ptsecurity.com/ww-en/analytics/web-application-attack-statistics-q1-2017/ https://www.ptsecurity.com/ww-en/analytics/web-application-a...
- ishitatsuyuki 8y agoI admit that SQL injection seems to be exploited more than I expect. However, 7-30% doesn't hold for actual vulnerability percentages: just because that there are more attacks doesn't mean that it's actually successfully exploited more.
- badrabbit 8y agoThere are a lot if automated scanners (mostly openvas,sqlmal and the like) that are continually scanning internet targets. Attack does not equate breach of security.
- world32 8y agoFair enough. You are right to distinguish between attempted attacks and successful exploitation. To be honest I cannot be bothered to properly read those articles I posted and see if they were talking about attempts or successful attacks. :-) Though having worked as a penetration tester I can say that, while rare, it was certainly not unheard of for a client's web application to be vulnerable to SQL injection. And this is for clients who are willing to spend several $1000s on a penetration test for their website - imagine what its like for people who don't give a second thought to the security of their site.
- cottenio 8y agoIt only takes one PHP developer using PDO to read an article like this one to open up SQL injection holes. http://pdo.w3clan.com/tutorial/176/like-clause-in-clause-and-limit http://pdo.w3clan.com/tutorial/176/like-clause-in-clause-and...