这是SQL注入错误？

Question

i want to know if is this sql injection error or what ? and what db is there ? mssql ?

A Database Error Occurred

Error Number: 1054
Unknown column '20and' in 'where clause'

For Query :-

select * from static_info where main_id=60%20and 
and language_code='az' order by id desc

At Location :-

Filename: /home/test/public_html/controllers/welcome.php
Line Number: 115

Answer 1

You need to use single quotes for character columns

select * from static_info where main_id='60%20and' and language_code='az' 
order by id desc

Answer 2

Yes this can be said as sql injection,because user can access your database from UTL, User can easily execute queries in database and harm to your database, If you notice [link] http://nidavh.org/news_index/1 , this will execute as a "select * from static_info where main_id=1 ..." and i can see staic pages by id. I hope you got my point

You should use parameterized query to prevent sql injections

 Select * from TableName where Columnname1='Your Paremeters' and Columnname2='Your Parameters'

Answer 3

They are using Codeigniter for the framework,

the error which you posted is just telling you there's no 20and field existed,

it's just an 404 Not Found like error, and the symbol which you trying to use will be escape ,

that's one way to prevent SQL injection, there's a lot also.

And if you trying to SQL injection then you'll get the following error:

An Error Was Encountered

The URI you submitted has disallowed characters.