The fix, in one snippet
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
After ownership verification, Scan.now applies bounded quote and boolean probes to existing GET parameters. It does not use data-changing statements, stacked queries, time delays, POST requests, login flows, or database extraction.
Why it matters
SQL injection can let an attacker read, change, or delete application data and sometimes take control of the database server.
How to fix it
Use parameterised queries for every value, including numeric IDs and search filters. Do not build SQL with concatenation or interpolation. Give the application database account only the permissions it needs.
Where this fits
SQL injection is check 1 of 19 that the sql injection vulnerability scanner runs under page content and javascript, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
What fixing this still leaves open
SQL injection closes one route in. Immediately below it: Server-side request forgery, where a URL-like parameter caused the verified server to request a unique Scan.now callback; Form submits over HTTP, where a form on the page submits to a plain-HTTP URL; JavaScript library with known vulnerabilities, where the page loads a JavaScript library version with published vulnerabilities.
Found in the same scan
The sql injection vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Path traversal / local file inclusion, where a path-like parameter returned a known local operating-system file signature. A single run of sql injection vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: SQL injection (critical severity)
Scanner check id: sql-injection-activeThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
