Skip to main content
3,818 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
0 votes
3 answers
182 views

For November 2025, the Prisma does not support the updating of multiple records with different values. Although the transactions are being considered as main workaround for such cases, the transaction ...
Takeshi Tokugawa YD's user avatar
  • 1,017
1 vote
2 answers
108 views

I am sending a json array with filter parameters from ExtJs in the sql function parameter. filters look like this: [{"field":"product_type_id","data":{"type":&...
Pawel's user avatar
  • 13
1 vote
2 answers
159 views

I'm working on a .NET application that needs to execute SQL parameterized by database objects like tables or columns. The application supports both the Microsoft SQL Server and Oracle ADO.NET ...
fff's user avatar
  • 67
1 vote
1 answer
126 views

I'm trying to create database users in my Postgres database from Golang, and I can't seem to get queries to run. I'm able to establish a connection, but I cannot run create user X with password Y and ...
Naftuli Kay's user avatar
  • 92.7k
2 votes
2 answers
171 views

I have an extension for Entity Framework Core query to support between and I see that the SQL being parsed includes literal values. Is it vulnerable for SQL injection attacks? This is the extension ...
Shmiel's user avatar
  • 1,287
0 votes
1 answer
115 views

Our company site is behind WAF based on NGINX ModSecurity. And permanently in WAF logs we see blocked requests from site forms. Example: SQL Injection Attack Detected via libinjection - Matched Data: ...
Marat's user avatar
  • 33
-1 votes
1 answer
168 views

I am working on a project and want to delete the table by passing the table_name which is coming from an API request. I want to bypass SQL Injection warning for delete query. I am using Python, and ...
Dhwanil Gandhi's user avatar
  • 1
-2 votes
1 answer
108 views

I'm developing a multi-tenant Python web application where users need to query different database tables based on their client context. The challenge is constructing secure SQL queries when table ...
Amira's user avatar
  • 33
1 vote
1 answer
87 views

I have a stored procedure that we are scanning using some AI tools to look for vulnerabilities. I am doing a dynamic SQL statement with an order by clause and that parameter for that order by I am ...
Morgeth888's user avatar
  • 263
1 vote
0 answers
83 views

I was asked to make this code SQL Injection proof: <?php $connection = mysqli_connect("localhost", "root", "password", "users_db"); $query = "SELECT * ...
kamilio3214's user avatar
  • 21
1 vote
2 answers
116 views

I'm developing a web application that interacts with Databricks using the Databricks SQL connector. The application allows users from different teams to add/rename/delete columns of existing tables. ...
Vinay Yogeesh's user avatar
  • 11
1 vote
1 answer
134 views

I'm trying to use Psalm to detect SQL Injections. I have the following code : $pdo = new PDO("mysql:host=db;dbname=tp;port=3306", "user", "password");; // VULNERABLE ...
Arthur Eudeline's user avatar
  • 687
0 votes
0 answers
82 views

I'm working on a C# application using Npgsql to query a PostgreSQL database. I have the following method that constructs a query dynamically while using parameterized queries to prevent SQL injection: ...
aim's user avatar
  • 95
0 votes
0 answers
87 views

I am working on a CTF. I need to do a SQL injection into a dummy website. In this website when signing up there is not input clean up of any sorts for the username field, and as a friend confirmed it ...
serax's user avatar
  • 222
0 votes
1 answer
308 views

I'm using Dapper in my project and I want to pass table name as a dynamic parameter in the query. This is my code: var tableName = GetTableNameDynamically<TEntity>(); using (var builder = new ...
Sumisha Sankar's user avatar
  • 3
0 votes
2 answers
285 views

I am doing research on ways to prevent SQL injection when using Entity Framework Core ORM. Most blogs and sources cite official Microsoft documentation, that the best way is to sanitize values, use ...
Myliak's user avatar
  • 58
0 votes
1 answer
88 views

This line of code using (objCmd = new SqlCommand(SPname1, objConn)) is getting flagged as a SQL injection: public DataSet GetTableByStoredProc(string strProcName, ArrayList alParams) //copy with ...
Jatin D's user avatar
  • 1
0 votes
0 answers
84 views

For now, I use python, with sql templating (jinja2) for BigQuery API (not sdk) + fastapi. The queries are generated from api parameters to sql code. Those queries are sent to BQ. To prevent sql ...
James's user avatar
  • 1,481
0 votes
0 answers
111 views

I am working on an ASP.NET web application, and a recent security scan (conducted using SecurityMetrics) flagged a vulnerability related to Blind SQL Injection (Time-Based). Here are the details of ...
Virender Thakur's user avatar
  • 529
-1 votes
1 answer
203 views

My project needs to access a SQL Server which has hundreds databases in it. All those databases have same tables structure So I need to query those data like this: select * from {0}.dbo.tableA where ...
Justin's user avatar
  • 1,166
0 votes
0 answers
138 views

I'm trying out SQL server's full-text search indexes and more specifically the CONTAINS function for finding out whether a column contains an exact match for a user's full name. I am using the Kotlin ...
emilelm's user avatar
  • 31
0 votes
2 answers
89 views

I need to concatenate strings to generate a query to execute, mainly because parameters cannot be used in the places I need to. For example, FETCH NEXT <n> ROWS clause in DB2 does not accept ...
Joe DiNottra's user avatar
  • 1,083
0 votes
0 answers
207 views

I am performing a scan with ZAP on my Nextjs 14 web application and I am encountering this security issue: Field Details Risk Level High Vulnerability SQL Injection - SQLite Description SQL injection ...
dandelionn's user avatar
  • 183
0 votes
1 answer
243 views

We have a command-line utility program that loads the specified file (CSV) into the specified table. Obviously, the table-name will be externally-provided (on command-line), and Veracode flags that as ...
Mikhail T.'s user avatar
  • 4,266
1 vote
0 answers
79 views

I am taking the course in Portswigger.net for SQLi and am stuck in Lab 12 where I cant seem to get the administrator password. I am using this https://github.com/rkhal101/Web-Security-Academy-Series/...
dyeacid's user avatar
  • 11
0 votes
3 answers
96 views

In Java, if a user input is directly appended to an SQL query without using methods like setString() or setInt(), but the query is executed using a PreparedStatement, is it still considered SQL ...
Uday Patel's user avatar
  • 1
0 votes
1 answer
86 views

I'm using Python 3 and SQLAlchemy to create dynamically a query that selects all the products that fulfill the conditions and avoids SQL injection issues. I get the following error: "List ...
PepeVelez's user avatar
  • 820
0 votes
0 answers
82 views

I was trying to perform some SQL Injection on bWAPP application. I a running test on medium level where query is like this. SELECT * FROM movies WHERE title LIKE '%".$(title)."%'; User will ...
Abdul Saqib's user avatar
  • 357
0 votes
0 answers
286 views

I'm walking through some online training and I'm stuck in a place where I have to use SQL injection via a UNION query. Here's the initial query: SELECT * FROM Transactions T LEFT JOIN Accounts as OA ...
Michael Bunton's user avatar
  • 1
-1 votes
1 answer
80 views

im doing portswigger blind sqli lab: https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses in the burp repeater after intecepting requests, it is working fine, as the ...
SAVEPALASTINE's user avatar
  • 59
0 votes
1 answer
861 views

This is a parametrized query: string sqlQuery = @"UPDATE MyTable SET MyTableItemName = @newName WHERE MyTableItemId = @id;"; await _context....
StanSm789's user avatar
  • 53
0 votes
2 answers
765 views

At university, we learned, and I also read in many places, that you should NEVER concatenate SQL strings. Yes, I know it's because of SQL injection, and I am aware of that. However, what if the string ...
Balint's user avatar
  • 21
0 votes
0 answers
92 views

I've developed a stored procedure that utilizes dynamic SQL to search for specific entities (this is a procedure for catch all logic). Is this procedure prone to SQL injection, and how do I get the ...
lifeisajourney's user avatar
  • 127
0 votes
1 answer
591 views

I have a POST form that includes a textarea for SQL content. Cloudflare will occasionally classify the content as a SQL Injection attempt and block the submission. Is there a safe or proper way to ...
Joel Cochran's user avatar
  • 7,783
1 vote
0 answers
51 views

I've implemented a PHP script to handle form submissions and insert data into a PostgreSQL database. However, I'm concerned about the potential security vulnerabilities, particularly SQL injection. ...
user avatar
0 votes
0 answers
63 views

I've done a search here on stackoverflow and read through some posts that are similar regarding PL/SQL SQL injection prevention, but they didn't seem to match my question specifically. This post ...
McRivers's user avatar
  • 383
1 vote
1 answer
564 views

Im using input from the user to query snowflake within DRF view, how to prevent in the below code sql injection possibility? entity_id = kwargs['pk'] table = session.table("my_table").filter(...
LiorA's user avatar
  • 85
-3 votes
1 answer
870 views

I have a Python script executing DB2 query as select count(*) as num_rows from {table} The value of {table} is read from a list of tables and I need to print out the count corresponding to each table. ...
Muradin's user avatar
  • 1
1 vote
1 answer
173 views

I have a procedure which will receive query in in parameter. I'm running the incoming query inside a procedure, and the Checkmarx tool detecting SQL injection in my_cursor. How do I solve this? I ...
Tamil Mani's user avatar
  • 23
1 vote
0 answers
279 views

I know that similar questions about the prevention of NoSQL injections exist. One example is this answer on the StackOverflow platform: https://stackoverflow.com/a/63839225/14043571 The answer ...
Ronald's user avatar
  • 187
0 votes
1 answer
109 views

Consider code similar to this: String orderBy = getParameter("orderBy"); String orderDir = getOrderDir(); // returns "asc" or "desc" String query = "select u from ...
Macok's user avatar
  • 9
1 vote
2 answers
538 views

I'm encountering an issue with whereFullText in Laravel. Here's my code: $search_key = $args['q'] ?? $args['search_key'] ?? NULL; $builder->when($search_key, function (Builder $builder, $search_key)...
arya_la's user avatar
  • 532
0 votes
1 answer
218 views

Hi I want to write a regular expression to search SQL Injection. For example ‘123) ORDER BY 1-- KhUB’)]) ‘123) ORDER BY 1435-- SQlQ’)]) ‘123) ORDER BY 1-- wIYj’)]) ‘123) ORDER BY 3116-- AdZB’)]) ‘123))...
Mozarti Generatiti's user avatar
  • 9
0 votes
0 answers
165 views

I am currently doing a pentest on a client's asp web application and I have identified a blind SQL injection. However, after enabling xp_cmdshell, I am only able to run the ping localhost command to ...
dawn breaker's user avatar
  • 1
0 votes
0 answers
39 views

I have developed a website with Laravel 9.X, which works correctly locally, but on my Host, I am having problems with an input, when I try to make an update. I have some input fields in an edit page, ...
Maida's user avatar
  • 415
0 votes
1 answer
733 views

The Opensearch documentation around using the low-level python client is here. When executing search queries it shows the following example: # Search for the document. q = 'miller' query = { 'size': ...
says's user avatar
  • 119
-1 votes
1 answer
158 views

I am attempting to make a web application (LAMP stack - MySQL version: 8.0.36-0ubuntu0.22.04.1) that is vulnerable to a SQL UNION Injection attack (or some type of SQL injection attack). The code ...
Guy's user avatar
  • 15
0 votes
2 answers
404 views

This is the implementation in code: the schema name comes from a configuration file and is different for each environment. Sonar throws SQL injection alert at this statement: select * from dbName.dbo....
Padmaja's user avatar
  • 111
1 vote
0 answers
41 views

I am learning about SQLI vulnerabilities, created an application in Flask with different vulnerable fields. One of these fields are HTTP headers. # Página para configurar una cabecera HTTP con un ...
mdz's user avatar
  • 11
2 votes
1 answer
80 views

I have very little knowledge about SQL injection, and there are probably other threats I am unaware of out there for stealing company data, how would I make this python code better in regards to ...
LT_AKR's user avatar
  • 81

1
2 3 4 5
…
77