SQL-injection | 解决sqlmap不能跑的注入

You are missing couple of %ss. Correct statement:

You have to whitelist the values of $field and concatenate it into the query:

Figured the issue out. It seems, in the new syntax you need to provide the input parameter in single quotes and not in triple single quotes

Works : 'foo'

Doesn't work : '''bar'''

Because This is the syntax of the SQL:

A scalar subquery is an ordinary SELECT query in parentheses that returns exactly one row with one column.

MySQL's prepare() does not support multi-query. You cannot run multiple statements separated by semicolons when you use prepare.

Reference: https://dev.mysql.com/doc/refman/8.0/en/sql-prepared-statements.html

SQL syntax for prepared statements does not support multi-statements (that is, multiple statements within a single string separated by ; characters).

If you set PDO::ATTR_EMULATE_PREPARES to false (which I agree is a good thing), then you must run each statement individually.

You don't need to use prepare() & execute() in your case, since your query has no parameters and you're only using it once anyway.

But there's no good reason to use multi-query anyway, whether you are using prepare or just executing the query directly. It's simpler to run the queries one at a time. Since none of these SQL statements has a result set, you can use PDO::exec().

Here is how I would code this:

The solution was as follows:

Since Content -Type = "text / xml" is required, I need to use JAXBEncoder. In this case, I need to send not a String, but a ChargeRqType - an object that was received using jaxb.

JPA Security is an Access Control Solution for the Java Persistence API (JPA). Its features include:

• High-Performance querying: With JPA Security your access control is performed in the database. You may query the database for all objects of a certain type and will get only the objects you have read access to. This filtering occurs in the database. Unaccessible queried objects will not be loaded into memory.
• Access Control via Configuration: JPA Security enables you to completely remove security-related code from your code-base. All of the access control may be configured via Annotations or XML.
• Support for role-based access control, access control lists (ACLs), and domain-driven access control: With JPA Security you do not have to change your access control paradigm (but maybe you want to when you see the great capability of JPA Security). You even can mix access control paradigms easily.
• Integration for Java EE Security and other frameworks: JPA Security is not designed to replace current security solutions, but to extend them. It integrates smoothly into the security mechanisms of the Java EE Platform but may be used with third-party frameworks like Spring Security or in Java SE, too.
• Easy Extensibility: With the extensibility of JPA Security it is easy to provide your own access control paradigm, access rules storage, or login mechanism.

Refer JPA Security Core for more details.

Short answer: Yes

Long answer:

Yes you are, because you dont actualy use the user input as an database field they cant manipulate it.

Aslong you doesnt directly put user input into your database you wont get problems with mysql injections.

Many People tell you to use prepared statments at every request, but you only have to use them if you directly use userinput in your querys like a username order an email.