Study Shows That 11% of Sites Are Vulnerable to SQL Injection Attacks
- Share
-
- |
Read later
My Reading List
In an informal study, Michael Sutton of SPI Dynamics was able to demonstrate that 80 out of 708 tested web sites were susceptible to SQL injection attacks.
In order to limit the test to sites that used a database, he first performed a Google search for sites with URLs containing "id=10". The assumption was that any site using a name=number pattern in the query string was most likely doing a database lookup. Using this, 1000 sites were selected.
After removing duplicates and non-functional sites, Michael Sutton was left with a pool of 708 candidate sites. By altering the query string, he found that 80 sites were returning error messages that suggested they were vulnerable to SQL injection attacks.
While study may not be formal enough for an academic paper, it does suggest that SQL vulnerabilities are a wide-spread problem among websites.
Protection against SQL Injection (request for comments)
by
Thomas Mueller
www.h2database.com/html/advanced.html#sql_injec...
What do you think about this solution?
Re: Protection against SQL Injection (request for comments)
by
Paul H
Other problems (derived from the request params issues) might occur like removal/retrieval of items, for what you don't have credentials, common mistake in all the web apps, but that's a design problem.
It would be nice to hear about solutions to avoid such flaws. I saw a few months ago an article about encrypting the url params etc, but i can't find the link :(.
Educational Content
Writing Usable APIs in Practice
Giovanni Asproni May 19, 2013
Hello stranger!
You need to Register an InfoQ account or Login to post comments. But there's so much more behind being registered.Get the most out of the InfoQ experience.
Tell us what you think