What characters have to be escaped to prevent (My)SQL injections?

by

A guess concerning the backspace character: Imagine I send you an email “Hi, here’s the query to update your DB as you wanted” and an attached textfile with

INSERT INTO students VALUES ("Bobby Tables",12,"abc",3.6);

You cat the file, see it’s okay, and just pipe the file to MySQL. What you didn’t know, however, was that I put

DROP TABLE students;\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b

before the INSERT STATEMENT which you didn’t see because on console output the backspaces overwrote it. Bamm!

Just a guess, though.

Edit (couldn’t resist):

alt text

More Related Contents:

  1. How do I escape reserved words used as column names? MySQL/Create Table
  2. How to escape apostrophe (‘) in MySql?
  3. What does it mean to escape a string?
  4. How to escape literal percent sign when NO_BACKSLASH_ESCAPES option is enabled?
  5. Are dynamic mysql queries with sql escaping just as secure as prepared statements?
  6. Mysqldump launched by cron and password security
  7. Mysql server does not support 4-byte encoded utf8 characters
  8. How to escape apostrophe (a single quote) in MySql?
  9. MySQL – Get row number on select
  10. How to create a secure mysql prepared statement in php?
  11. How to use GROUP_CONCAT in a CONCAT in MySQL
  12. MySQL query / clause execution order
  13. How can I tell when a MySQL table was last updated?
  14. Operand Should Contain 1 Column – MySQL NOT IN
  15. Error Code: 1005. Can’t create table ‘…’ (errno: 150)
  16. MySQL: Error Code: 1118 Row size too large (> 8126). Changing some columns to TEXT or BLOB
  17. On duplicate key ignore? [duplicate]
  18. List of Stored Procedures/Functions Mysql Command Line
  19. How to design a multi tenant mysql database
  20. How to get the count of each distinct value in a column? [duplicate]
  21. Get results that fall within marker radiuses from database
  22. MySQL date format
  23. How to get current date & time in MySQL?
  24. How do I split the output from mysqldump into smaller files?
  25. MySQL Group By Hours
  26. RMySQL dbWriteTable with field.types
  27. MySQL Alter table causes Error: Invalid use of NULL value
  28. uninitialized constant MysqlCompat::MysqlRes (using mms2r gem)
  29. Migrating data into Firebase from MySQL
  30. Inventory management with stock options

Leave a Comment