SQL injection

[vern]

---

XSS is not the same as SQL injection. Below is an example of an XSS flaw:

<?php
    echo $_GET['test'];
?>

As you can see, it allows the attacker to print unfiltered input to the browser but the attacker cannot touch the database in any way. To test it, simply do:

http://example.org/yourscript.php?test=%3Cscript%3Ealert%28%27this%20is%20a%20test%27%29%3B%3C%2Fscript%3E

I realize they are two different things. My point is XSS can be used to perform an SQL injection.

An important point to keep in mind while choosing your regular expression(s) for detecting SQL Injection attacks is that an attacker can inject SQL into input taken from a form, as well as through the fields of a cookie.

Detection of SQL Injection and Cross-site Scripting Attacks

If you do not filter your input, then that input could very well execute commands that it wasn't meant to.