1. Support Center
  2. Issue Definitions
  3. SQL statement in request parameter

SQL statement in request parameter

Description: SQL statement in request parameter

HTTP requests sometimes contain SQL syntax. If this is incorporated into a SQL query and executed by the server, then the application is almost certainly vulnerable to SQL injection.

When SQL-like syntax is observed, you should verify whether the request contains a genuine SQL query and whether this is being executed by the server.

Remediation: SQL statement in request parameter

Applications should not incorporate any user-controllable data directly into SQL queries. Parameterized queries (also known as prepared statements) should be used to safely insert data into predefined queries. In no circumstances should users be able to control or modify the structure of the SQL query itself.

References

Vulnerability classifications

Typical severity

Medium

Type index

0x00400480

Burp Scanner

This issue - and many more like it - can be found using our web vulnerability scanner

Read more

Get Burp

Scan your web application from just $399.00

Find out more