What are ALL THE MySQL commands that can be used to do an injection in a code?
I have disabled UNION and CONCAT.
I have a very basic application so no need for any complex queries so what else can I disable to make sure injections are a non issue?
Yes I have sanitized all variables as far as I know. The issues is it is a project with multiple parties and I have noticed some sloppy work in some libraries I have been handed to work with.
I was thinking on getting all the post variables sanitizing them an putting them back but that would be quite a complex task due to the complex multidimensional nature of some post variables.
Injection is possible with just about any type of SQL statement.
The only safe method of avoiding injections is to use prepared statements and bind data to query parameters.