Question

Some hackers have access to my database and i am going to find the bug; i have not access to server logs.
I made this code for saving suspicious queries on a text file :

function query($query) {
$file = 'sqllog.txt';
if(/* Which condition should i use to detect? */){
$contents = file_get_contents($file);
$contents.="\r\n";
$contents.=$query;
file_put_contents($file,$contents);
}
$this->theQuery = $query;
return mysql_query($query, $this->link);
}

Which condition should i use to detect sql injection suspicious queries?

Answer 1

You should look for non-sanitized inputs (i.e. no use of mysql_real_escape_string) in your codebase. Ideally call this function right before inserting the parameters into your queries.

Alternatively, consider switching to prepared statements using PDO and SQL injection will no longer be an issue.