SQL注入尝试 - 我的代码容易受到攻击吗？

Question

I found in my logs that someone is trying to attack my page. I have some sub-pages where data is pulled from an DB via an ID that is submitted by the URL. Like page.php?id=666 What I could find in my logs are these attacks:

page.php?id=../../../../../../../../../../etc/passwd
page.php?id=/proc/self/environ
page.php?id=-1%27

And even more important, is my code weak? Might this attack have been successful?

$id = intval($_GET['id']);
$stmt = $con->prepare("SELECT *
    FROM mytable AS myvar
    WHERE myvar.ID =:ID");
    $stmt->bindValue(':ID', $id, PDO::PARAM_INT);
    $stmt->execute();

Thanks in advance!

Answer 1

No, this code is not vulnerable to SQL injections.

Both the intval conversion and prepared statement with PDO::PARAM_INT binding ensure that only integer values are used in the comparison of the statement that is being executed.

Anyways, the mentioned requests don’t seem to aim for identifying SQL injections only but several different vulnerabilities, e. g., Path Traversal (CWE-22) and Local File Inclusion (CWE-98) as well. So you may want to watch out for those vulnerabilities as well.