Zennoxa Shield
Rules / PHP
SHIELD-PHP-002

SQL injection via mysql_query with user input

criticalPHPCWE-89CVSS 9.8

What it detects

Legacy mysql_query call includes request superglobals or concatenated variables in the SQL string.

How to fix

Migrate to PDO or mysqli with prepared statements and bound parameters.

Vulnerable — Shield flags thisuser.php
<?php
// Legacy user lookup — vulnerable to SQL injection
$result = mysql_query("SELECT * FROM users WHERE id = " . $_GET['id']);
while ($row = mysql_fetch_assoc($result)) {
    echo htmlspecialchars($row['name'], ENT_QUOTES) . "<br>";
}
Fixed — scans cleanuser.php
<?php
// Parameterized query with PDO — user input is bound, never concatenated
$pdo = new PDO('mysql:host=localhost;dbname=app', 'app', getenv('DB_PASSWORD'));
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([(int) $_GET['id']]);
foreach ($stmt->fetchAll() as $row) {
    echo htmlspecialchars($row['name'], ENT_QUOTES) . "<br>";
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-002: SQL injection via mysql_query with user input — Zennoxa Shield