Jeffro Posted September 16, 2011 Share Posted September 16, 2011 I have a classifieds script that I run that has a few thousand entries. The last 2 nights.. out of nowhere, several of my categories (different ones each night) went from over 100 results to 0. I'm not running any cron jobs of any kind. I have no idea how these entries just disappeared. Is there a way I can tell if someone is running sql injection attacks on my site? Can I check for sql vulnerabilities in my script? Any other advice as to how I might figure out what's going on? I host with hostgator. Is there some auditing I could employ on mysql.. or the site itself? Many thanks for any suggestions. Quote Link to comment https://forums.phpfreaks.com/topic/247298-can-i-find-out-if-someone-is-doing-a-sql-injection-attack/ Share on other sites More sharing options...
Pikachu2000 Posted September 16, 2011 Share Posted September 16, 2011 Have you checked your Apache logs for abnormalities? Are you logging MySQL queries anywhere? Install SQLInjectMe for Firefox, and run it against any forms you have on your site. It will non-destructively run tests and report any vulnerabilities it finds. Quote Link to comment https://forums.phpfreaks.com/topic/247298-can-i-find-out-if-someone-is-doing-a-sql-injection-attack/#findComment-1270031 Share on other sites More sharing options...
Jeffro Posted September 16, 2011 Author Share Posted September 16, 2011 thx pikachu. I'll look into installing that addon at home later. I tried here and it won't work with the latest version of firefox (much like every freaking add-on i ever try to use in firefox). Thanks for the great tip though. I've not viewed any logs either.. but I'll definitely start looking into how to do this with hostgator (haven't done much with server admin stuff so it will all be new). Thanks again! Quote Link to comment https://forums.phpfreaks.com/topic/247298-can-i-find-out-if-someone-is-doing-a-sql-injection-attack/#findComment-1270034 Share on other sites More sharing options...
fenway Posted September 16, 2011 Share Posted September 16, 2011 Simple question -- are you using a DB class, or are you coding each sql statement yourself? If it's the latter, you're likely vulnerable. Quote Link to comment https://forums.phpfreaks.com/topic/247298-can-i-find-out-if-someone-is-doing-a-sql-injection-attack/#findComment-1270112 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.