Sql Injection is possible if parameters are passed via GET. But is it possible via POST also. If yes, can https prevent it?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Sql Injection is possible if parameters are passed via GET. But is it possible via POST also. If yes, can https prevent it?
Yes, it’s possible with
$_POSTas well as with$_GET,$_COOKIEand$_REQUEST. HTTPS will not protect you at all. You have to use some function to protect you, for example mysql_real_escape_string or use prepared statements.All communication from the web browser should be handled as “untrusted”. Other techniques you can’t trust is
Ajax,file uploadsandJavaScript form validations(among others). All these data come directly from the web browser and should not be trusted before you have filtered them or validated the data.The only thing you can trust is
$_SESSION, provided that you ONLY put in validated data into your$_SESSIONvariables.