Is SQL injection possible with POST?

Question

Sql Injection is possible if parameters are passed via GET. But is this also possible through POST. If so, can https prevent this?

Answer 1

Yes, possibly with $_POST, as well as with $_GET, $_COOKIEand $_REQUEST. HTTPS will not protect you at all. You should use some function to protect you, for example mysql_real_escape_string or use prepared statements .

All messages from a web browser should be treated as "untrustworthy . " Other methods you cannot trust are Ajax, file uploadsand JavaScript form validations(among others). All of this data comes directly from a web browser and should not be trusted before you filter it or verify the data.

The only thing you can trust is $_SESSIONif you only included validated data in your variables $_SESSION.

Answer 2

• Yes, you can enter SQL through POST. Anyone can change what sends POST requests (find the addon for firefox called "hackbar"
• https , -. .

Answer 3

.

Answer 4

, .

SQL- , SQL-, . , GET POST, . , , .

Answer 5

, , - . , , , - - SQL-, , , .

, PHP , - Codesense mysqli wrapper. , , , , , .

SQL , SQL, .

Answer 6

https cannot protect you here. Filter input (s)