SQL Injection Vulnerability

Why This Happens

SQL injection occurs when user input is directly concatenated into SQL queries, allowing attackers to modify the query logic. They can extract data, modify records, or even drop tables. Prepared statements with bound parameters completely prevent this by separating SQL code from data.

The Problem

// VULNERABLE: Direct string concatenation
$username = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = $pdo->query($query);
// Attacker: username = ' OR '1'='1

The Fix

$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->execute(['username' => $_POST['username']]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

Step-by-Step Fix

1. 1

   Find concatenated queries

   Search for SQL queries that include PHP variables via string concatenation or interpolation. These are SQL injection vulnerabilities.

2. 2

   Convert to prepared statements

   Replace all dynamic SQL with PDO prepared statements using named (:param) or positional (?) placeholders.

3. 3

   Set PDO error mode

   Configure PDO with ERRMODE_EXCEPTION to catch query errors: new PDO($dsn, $user, $pass, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]).