Welcome to the SQL Injection Hall-of-Shame
In this day and age it’s ridiculous how frequently large organizations are falling prey to SQL Injection (SQLi) which is almost totally preventable as I’ve tell people all the time as part of my day job at Parasoft and written previously.
Note that this is a work in progress. If I’ve missed something you’re aware of please let me know in the comments at the bottom of the page or on Twitter.
Don’t let this happen to you! For some simple tips see the OWASP SQL Injection Prevention Cheat Sheet. For more security info check out the security resources page and the book SQL Injection Attacks and Defense
Pingback: SQL Injection Hall of Shame updated - The Code Curmudgeon
Pingback: SQL Injection is So "2000-and-Late" - The Code Curmudgeon
Pingback: Episode 4 – OWASP and You!
Pingback: Estándares de configuración segura (hardening) en PCI DSS - PCI HispanoPCI Hispano
Pingback: 5 Website Security Checks: Are you at risk? - Server Density Blog
Pingback: Die 10 katastrophalsten Sicherheitslücken – Teil 1 › PSW GROUP Blog
Pingback: SQL Injection Hall-Of-Shame / Internet-of-Things Hall-Of-Shame « Another Word For It
Pingback: Les injections SQL | securitywatchblog
Pingback: Five Reasons Why You Should Care About Application Security | AppSecure Labs
Pingback: Securing the SDLC – InfoSec News
Pingback: SQL Injection - A Pain That's Not Going Anywhere - The New Developer
Pingback: Blog do Laboratório de Investigação » Blog Archive » Veja as principais ameaças para as startups
Pingback: Website Security | Frank DeCaire
Pingback: Russian hacker Rasputin breaches over 60 Universities and Government Agencies – sec.uno
Pingback: Russian hacker Rasputin breaches over 60 Universities and Government Agencies – Jighi Blog
Pingback: Block SQL injections, not your customers - Sqreen Blog | Application Security For Developers
Pingback: Russian-Speaking Hacker Sells SQLi for Unauthorized Access to Over 60 Universities and Government Agencies ~ CrackWare
Pingback: A Closer Look: OWASP Top 10 Application Security Risks
Pingback: The OWASP Top 10 is killing me, and killing you! | HPE – Startupon.net
Pingback: The OWASP Top 10 is killing me – L Technology Group
Pingback: A Closer Look: OWASP Top 10 2017 – Application Security Risks – Devasted Blog
Pingback: A Closer Look: OWASP Top 10 2017 – Application Security Risks - Security Boulevard
Pingback: SQL Injection Protection in Cloud Systems
Pingback: A Panoply of SQL Injection Horrors | Mitigated Frenzy
Pingback: Checkmarx Understanding Application Security Vulnerabilities: Part One - Checkmarx.com
Pingback: Understanding Application Security Vulnerabilities: Part One
Pingback: SQL injection and CFML 101 – Marcus Fernstrom
Pingback: Why is my stored proc slow in .Net? | esotechnica
Pingback: Understanding Application Security Vulnerabilities: Part One
Pingback: Not Entirely Parameterized Dynamic SQL – Erik Darling Data
Pingback: SQL injection - SQL Server Fast
Pingback: 每周分享第 43 期
Could you provide sources to the incidents if available? Like news articles and alike.
Every item has a link to the news article in the last column of the table.
Sorry, did not see them in mobile version. Just off the Screen.
Pingback: Top website security threats and how to protect your site from attack – Technology Revolution
Pingback: Not Entirely Parameterized Dynamic SQL | Erik Darling Data
Pingback: Just Using sp_executesql Doesn't Make Dynamic SQL Safe To Use | Erik Darling Data
Pingback: Starting SQL: What Are Parameters Made Of? | Erik Darling Data
Pingback: Starting SQL: What Happens When You Don't Parameterize Queries? | Erik Darling Data
Pingback: Almost 17 Years of SQL Injection, Are We Done Yet? - Geek Speak - Resources & Events - THWACK
Pingback: Combating SQL Injection | SQL Solutions Group
Pingback: Security insights from a cyber-aware software development team | Redscan
Pingback: Software Vendor Mistakes With SQL Server: Writing Unsafe Dynamic SQL – Erik Darling Data
Pingback: SQL Injections and Election Security - Parasoft
Pingback: Starting SQL: What’s The Difference Between Parameters And Local Variables In SQL Server? – Erik Darling Data
Pingback: Starting SQL: What Happens When You Don’t Parameterize SQL Server Queries? – Erik Darling Data
Pingback: Different Ways To Parameterize Queries In SQL Server – Erik Darling Data