Hello, I am developing a website and penetration testing. It is built in CakePHP, which informed me that:
CakePHP already protects you from SQL Injection if you use CakePHP ORM Methods (such as find () and save ()) and the correct array (i.e. array ('field' => $ value)) instead of raw SQL.
However, I am not sure what data needs to be entered into the fields of my input form in order to check the prevention of SQL injection.
I have the following table names with simple VARCHAR attributes -
categories: name
clients: address, county, country, name
items: name
statuses: name
Would this SQL statement, entered into the form and submitted, be the right way to test an SQL injection attempt?
DROP TABLE "categories";
After submitting this value to the form, the value entered into the database was:
DROP TABLE "categories";
, , - SQL-, ?