CODEWITHSUNDEEP
phporacle-databasesql-injection
britter
britter

Reputation: 151

SQL injection in oracle with sanitized input

I'm looking at some old PHP code, trying to figure out if it's vulnerable to SQL injection. My boss believes it's safe, but I'm hesitant to accept that. It's using an Oracle DB.

It's old code, and the query is being built via string concatenation (sprintf). However, the user input string has all hyphens and spaces removed (via str_replace), and addslashes() is called on it. Is there still any threat of an attack in this case? Can you give an example?

Since the code was written we have moved to using parametrized queries, so ideally we update it to that, but I'm trying to prove the need to do so.

Upvotes: 1

Views: 493

Answers (1)

Matthew Brown aka Lord Matt
Matthew Brown aka Lord Matt

Reputation: 2307

There are some examples of how to inject attack something using addslashes here:

If that little lot does not convince the boss then maybe set up on a test server and create a POC injection against the code using what is explained in the above links to give a demonstration of an attack. A drop tables is quite dramatic as is tricking the script into spewing out the DB contents onto the page.

Upvotes: 2

Related Questions