Is there a way to specify PHP escape method when using SQLmap?

Question

I'm helping a collegue of mine to test if his website is completely SQLi-proof. It looks promising, but i'm trying to make sure, and by chance I know he's using pg_escape_string to sanitize his POST input.

This may be a stupid question, but I'd like to know, if there is a way to specify the escape method for SQLMap?

Also as long as I'm here, I'd like to ask for opinions which would be the best escape method to use (PHP-PostgreSQL combination) is pg_escape_string sufficient or should he use something else?

Answer 1

Have a look on PHP PostgreSQL Prepared Statements. It will escape your variables just fine and it will help you with forgetting to escape something, or double-escape.

Answer 2

Using sqlmap to look for sql injection vulnerabilities when you have access to source code is the wrong approach. There are many reasons for this, but allow me to mention a few:

1. sqlmap cannot defeat application logic.
2. sqlmap sometimes has false negatives.
3. sqlmap cannot find or exploit all types of injections, such as second order injection.
4. sqlmap is going to be very slow as it tries to brute force many types of injection vectors
5. sqlmap cannot find xss, cmd injection, ssrf and other flaws that may be present in the source code.

You should look at using a source code analysis tool like rips, rats or graudit in combination with your database and web server logs to find and verify these (and other types) vulnerabilities.