SQL statement in request parameter
Description: SQL statement in request parameter
HTTP requests sometimes contain SQL syntax. If this is incorporated into a SQL query and executed by the server, then the application is almost certainly vulnerable to SQL injection.
When SQL-like syntax is observed, you should verify whether the request contains a genuine SQL query and whether this is being executed by the server.
Remediation: SQL statement in request parameter
Applications should not incorporate any user-controllable data directly into SQL queries. Parameterized queries (also known as prepared statements) should be used to safely insert data into predefined queries. In no circumstances should users be able to control or modify the structure of the SQL query itself.
- Web Security Academy: SQL injection
- Using Burp to Test for Injection Flaws
- Web Security Academy: SQL Injection Cheat Sheet