Code review

String concatenation

One of the possible sinks in code when it comes to SQL Injection is using string concatenation instead of parametrized queries:

Vulnerable code samples:

• Pasting the data directly from parameter without prepared statements

$id = $_GET['id']; // User input taken directly from GET request

$query = "SELECT * FROM users WHERE id = '$id'";

• Concatenation

$username = $_GET['username'];
$password = $_GET['password'];

// Vulnerable SQL query using string concatenation (username and password)
$query = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . $password . "'";

Non-vulnerable code sample:

$id = $_GET['id'];

$stmt = $mysqli->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $id);

Narrowing the search

Usually web applications have huge amounts of code. That is why we often have to use regexes in order to search for queries.

Sample regex searching (in notepad++)

^.*?query.*?select.*?