Is SQL Injection possible with POST?

Question

Sql Injection is possible if parameters are passed via GET. But is it possible via POST also. If yes, can https prevent it?

Answer 1

Yes, it's possible with $_POST as well as with $_GET, $_COOKIE and $_REQUEST. HTTPS will not protect you at all. You have to use some function to protect you, for example mysql_real_escape_string or use prepared statements.

All communication from the web browser should be handled as "untrusted". Other techniques you can't trust is Ajax, file uploads and JavaScript form validations (among others). All these data come directly from the web browser and should not be trusted before you have filtered them or validated the data.

The only thing you can trust is $_SESSION, provided that you ONLY put in validated data into your $_SESSION variables.