Running an SQL Injection Attack - Computerphile
Why Stack Overflow recommends it
Stack Overflow users link it when answering questions whose code builds SQL from raw user input, to show why that is exploitable.
Recommended by 2 people across 2 different months, 2016 to 2019.
What it is
Dr Mike Pound of the University of Nottingham explains how SQL injection works and demonstrates running an attack against a vulnerable site, showing how much damage unsanitised input can do. It is a Computerphile explainer filmed by Sean Riley.
What people said
Recommends Donran · 2019-04 · Stack Overflow · on “undefined index error when storing data from php to phpmyadmin using sql”
I don't see anything in the code you've posted that would cause this, it seems as if though the data is not sent through POST, or sent at all. Please provide the actual form sending the data as well. Something I'd like to mention is that you look up prepared statements [LINK] for SQL as this code is exploitable through a method called SQL Injection [LINK] as you are using data directly provided by the user without actually looking at it. This can result in an attacker carefully crafting some data to make their own SQL query. Here is a video [this video] made by Computerphile explaining this attack method better.
Recommends Jake H. · 2019-06 · Stack Overflow · on “Need help understanding SQL-injection vulnerability in a restful API”
Your question seems to be more asking what's the risk of SQL Injection? I'd say the easiest way to understand the risk is to watch these two well done videos by Computerphile ( video 1 [LINK] video 2 [this video] ). There's lots of ways to sanitize your inputs before hitting the database with it.
Cites Xavier J · 2016-07 · Stack Overflow · on “How to update a table in database using c#?”
Solution: Change the double-pipe ( || ) characters to comma ( , ) Like so: string Query = "UPDATE Members SET MemberID='" + MemberIDTextBox.Text + "', Name='" + NameTextBox.Text + "', Gender='" + GenderComboBox.Text + "', Address='" + AddressTextBox.Text + "', NID='" + NationalIDTextBox.Text + "', DOB='" + DOBTimePicker.Text + "', BloodGroup='" + BloodGroupTextBox.Text + "', Height='" + HeightTextBox.Text + "', Weight='" + WeightTextBox.Text + "', ChestSize='" + ChestSizeTextBox.Text + "', MusclesSize='" + MusclesSizeTextBox.Text + "', AbsPack='" + AbsPackTextBox.Text + "', Profession='" + ProfessionTextBox.Text + "', Contact='" + ContactTextBox.Text + "' WHERE MemberID='" + MemberIDTextBox.
Cites exhuma · 2019-10 · Stack Overflow · on “sqlite3.OperationalError: no such table: my_boardgames BUT ITS THERE”
nb: I slightly reformatted the text-strings for readability by splitting the lines. You are not interpolating the variable values into the query string. The following line conn.execute( "INSERT INTO my_boardgames " "(game_name,genre,recage,playtime,players) " "VALUES " "(val_game_name,val_genre,val_rec_age,val_play_time,val_players)"); Needs to be replaced with conn.execute( "INSERT INTO my_boardgames " "(game_name,genre,recage,playtime,players) " "VALUES " "(?, ?, ?, ?, ?)", (val_game_name, val_genre, val_rec_age, val_play_time, val_players)); Additional Information As you mentioned in the comments that you are a programming novice, I will add more information The following code will only u