How to find out if there are scripts vulnerable to SQL injection on any site? I heard there are even specials. programs, but I'm interested in how to determine yourself by URL.

  • 6
    Eh, Artem, you better deal with it. - Costantino Rupert
  • Read the security articles and use placeholders in SQL queries. - invincible
  • Is it so hard to write id = 1 or id> 0? - Vyacheslav Kirichenko

2 answers 2

By URL?) If everything was so simple)) Vulnerability can also be in a POST request. In GET, it is enough to change any data to something from SQL

http://www.site.ru/news.php?news_id='--

If this gives an error, there is a vulnerability. This is a common case, address, variables, etc., are changing.

  • one
    Quotes can be double, so the case with ' can roll :) - Alex Kapustin
  • An error by quotation mark in id (for example, if id should be a number) does not mean at all that there is a similar vulnerability. - avp
  • @avp, it was not meant "Record not found", but a fatal failure and "Check syntax in ...") - Sh4dow

Forgot to add that sql injections are in the cookies. Anything that can be sent to the site can be a potential injection or xss.

To find an injection on the site, you need to know the basics and features of the SQL server and the SQL language itself, judging by the question, you should start studying from these points.