SQL injection works with """;-- code example

Example 1: sql injection attack

$value = "your value here";

try {
            $pdo = new PDO($dsn, $username, $password, $>drivers);
        } catch (\PDOException $e) {
            echo 'Connection Failed: ' . $e->getMessage();
        }
        
$sql = "INSERT INTO `my_db` SET `field` = ? ";
$stmt = $this->pdo->prepare($sql);
        $stmt->bindValue(1, $value, PDO::PARAM_STR);
        $stmt->execute();
        $stmt = null;

Example 2: mitigation of sql injection

String tableName;
switch(PARAM):
  case "Value1": tableName = "fooTable";
                 break;
  case "Value2": tableName = "barTable";
                 break;
  ...
  default      : throw new InputValidationException("unexpected value provided"

Tags:

Sql Example

Related