Is there a canonical SQL injection page that I can point people towards when they post a question with an SQL injection vulnerability? Is it polite to do this. Sometimes, I know it's just an example, and that it isn't real code so it's OK if it has SQL injection vulnerabilities. However, when it's a new user, with low rep asking a very simple question, I find it very hard not to try and teach them about the dangers of SQL Injection. Is there a specific Stackoverflow question I can point them to? Or is there some other page on the internet that better explains the problem. and can help them fix it.

  • 2
    Whenever you encounter somebody smoking a cigarette, do you also find it very hard not to try to teach them about the dangers of cigarette smoking? – Gabe May 7 '11 at 4:04
  • 4
    @Gabe: There's a big difference. If the smoke of the cigarette blown into the wrong direction could expose millions of banking accounts, then yes, I'd tell them that they should quit smoking. Smoking is more like Global Variables. – Time Traveling Bobby May 9 '11 at 14:32
  • Does the question belong to SO? – GrzegorzOledzki May 9 '11 at 16:16
  • I honestly think the SO engine could/should parse code snippets in PHP+mysql tagged questions and autolink to some canonical question if it contains both mysql_query and $_GET/ $_POST / $_REQUEST. – therefromhere Feb 11 '12 at 0:42

Yes, xkcd's Little Bobby Tables is standard. It must be one of the most frequently linked pages at SO.

  • 4
    While funny, it doesn't really get the point across to somebody who is not familiar with the problem. Also, it doesn't really explain how it can be fixed. – Kibbee May 7 '11 at 1:35
  • 4
    On the contrary, a light-weight version of "you are doing something really dumb" is much more effective. Somebody that can't take that hint (they made a cartoon about it!) and research this problem by himself cannot be helped. Link to a dup if you have to. – Uphill Luge May 7 '11 at 1:57
  • Some people occasionally made it into a tag: meta.stackexchange.com/questions/32108/… – Andrew Grimm May 9 '11 at 13:48
  • Don't forget to mention that this comic strip got his own homepage! – Time Traveling Bobby May 9 '11 at 14:27
  • @Bobby: Are you named after Robert drop tables? – Andrew Grimm May 9 '11 at 23:16
  • @Andrew Grimm: Not that I know of, but my name is Robert, though. – Time Traveling Bobby May 10 '11 at 6:49

You could author the tag wiki page and point people towards that.


Why, uh, here's a nice answer to a sql injection question that you could link to. Over and over. Pretty please.

  • Interesting - the question had been viewed 7.5 Ktimes, but there was code that hadn't been highlighted. – Andrew Grimm May 9 '11 at 13:53
  • @AndrewGrimm: All of the sql code is in code blocks. As for why it hasn't been colored properly I can't quite tell... brb sandbox. – user1228 May 9 '11 at 13:58
  • @Will - sorry, I was referring to one of the answers not having code highlighted. – Andrew Grimm May 9 '11 at 13:59
  • @AndrewGrimm: Sql isn't getting prettified... meta.stackexchange.com/questions/90521/… – user1228 May 9 '11 at 14:05
  • There are quite a few [sql-injection] questions that don't have a language specified, so I just set the default highlighting on the tag to lang-sql. – mmyers May 9 '11 at 14:28
  • @mmyers: Doesn't appear to be working for my incredibly awesome answer – user1228 May 9 '11 at 16:12
  • No? This is what I see. – mmyers May 9 '11 at 16:14
  • @mmyers: I swear it wasn't doing it when I looked at it earlier. Perhaps cache? – user1228 May 9 '11 at 16:22

Point them to OWASP, they have good ressources that explains well the security problem, what to do and what not to do. It is one of the rare places that you are sure to find quality information about security problem.

Pages they have about SQL Injection :

SQL Injection
Guide to SQL Injection
SQL Injection Prevention Cheat Sheet
Reviewing Code for SQL Injection


I'm a fan of the Wikipedia page on SQL injection because it provides an adequate description of the problem, provides an overview of the solution, and lists notable hacks where it was a factor.

It's also rather long, so it might not actually be read.


Someone needs to do a rant on the subject equal to the Cthulhu answer on regular expressions and HTML.


This answer seems like a reasonable bet for PHP + MySQL, which I'd bet is the worst offender:

How can I prevent SQL injection in PHP?

I've just edited in a link to the bobby tables question to give context.


I learned about it at sqlzoo.net/hack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .