SQL injection/Basics/Injection Points

SQL injection > Basics > Injection Points

An SQL injection vulnerability's type is determined by the location of the user input. $input is used as an example input variable in the queries below to illustrate their classifications.

• SELECT ... WHERE clause injection

$query = "select * from table where id=$input";

• SELECT ... LIMIT, OFFSET, ORDER BY, and GROUP BY clause injections

$query = "select * from table limit $input"; $query = "select * from table limit 1 offset $input"; $query = "select * from table order by $input"; $query = "select * from table group by $input";

• UPDATE ... SET clause injection

$query = "update table set var=$input";

• UPDATE ... WHERE clause injection

$query = "update table set var=value where column_name='$input'";

• INSERT ... VALUES clause injection

$query = "insert into table values(null,$input)";