Study Shows That 11% of Sites Are Vulnerable to SQL Injection Attacks

| by Jonathan Allen Follow 323 Followers on Sep 30, 2006. Estimated reading time: less than one minute |

A note to our readers: As per your request we have developed a set of features that allow you to reduce the noise, while not losing sight of anything that is important. Get email and web notifications by choosing the topics you are interested in.

In an informal study, Michael Sutton of SPI Dynamics was able to demonstrate that 80 out of 708 tested web sites were susceptible to SQL injection attacks.

In order to limit the test to sites that used a database, he first performed a Google search for sites with URLs containing "id=10". The assumption was that any site using a name=number pattern in the query string was most likely doing a database lookup. Using this, 1000 sites were selected.

After removing duplicates and non-functional sites, Michael Sutton was left with a pool of 708 candidate sites. By altering the query string, he found that 80 sites were returning error messages that suggested they were vulnerable to SQL injection attacks.

While study may not be formal enough for an academic paper, it does suggest that SQL vulnerabilities are a wide-spread problem among websites.

Rate this Article

Adoption Stage

Hello stranger!

You need to Register an InfoQ account or or login to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Tell us what you think

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Protection against SQL Injection (request for comments) by Thomas Mueller

There is an abvious way to protect against this vulnerability: don't embed user input into the SQL statement, use parameterized statements instead. I suggest that this should be enforced by the database engine (or, by the driver), by disabling literals in SQL statements. See here for more details:

What do you think about this solution?

Re: Protection against SQL Injection (request for comments) by Paul H

It's the standard solution :).
Other problems (derived from the request params issues) might occur like removal/retrieval of items, for what you don't have credentials, common mistake in all the web apps, but that's a design problem.

It would be nice to hear about solutions to avoid such flaws. I saw a few months ago an article about encrypting the url params etc, but i can't find the link :(.

lies damn lies... by Jelmer Kuperus

pfff or an error is shown because the parameter cannot be parsed to a string. This doesnt say anything

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

3 Discuss

Login to InfoQ to interact with what matters most to you.

Recover your password...


Follow your favorite topics and editors

Quick overview of most important highlights in the industry and on the site.


More signal, less noise

Build your own feed by choosing topics you want to read about and editors you want to hear from.


Stay up-to-date

Set up your notifications and don't miss out on content that matters to you