Is this query vulnerable to sql injection?

Question

``` $myq = sprintf("select user from table where user='%s'", $_POST["user"]); ``` I would like to know if the above query can be exploited using SQL injection. Is there any advanced SQL injection technique that could break `sprintf` for this particular query?

Accepted Answer

I don't think it needs to be particularly advanced... try an input of

```
' OR 1 = 1 OR user='
```

In other words, you'll get SQL of:

```
select user from table where user='' OR 1 = 1 OR user=''
```

Does that look like a query you really want to execute? (Now consider the possibility of it dropping tables instead, or something similar.)

The bottom line is that you should be using a parameterised query.

Is this query vulnerable to sql injection?

Solution

Problem