fix(sqli-blind): use prepared statements to prevent blind SQL injection (CWE-89)

[markuszaki]

Blind SQL Injection Fix

Vulnerability: CWE-89 - SQL Injection (Blind)
OWASP Top 10: A03:2021 - Injection
Challenges Fixed: 3 (Low, Medium, High)

Issue

Blind SQL injection allowed attackers to extract data through boolean/time-based inference.

Fix

All three security levels now use:

• ✅ Prepared statements with
• ✅ Type-safe parameter binding
• ✅ No SQL error messages leaked
• ✅ Consistent response times (prevent timing attacks)

Files Changed

• vulnerabilities/sqli_blind/source/low.php
• vulnerabilities/sqli_blind/source/medium.php
• vulnerabilities/sqli_blind/source/high.php

Security Pattern: Prepared statements + generic responses

---

Verification: Patterns validated via ad-hoc script ✓

[github-actions]

🏆 DVWA — CTF Patch Score

█░░░░░░░░░░░░░░░░░░░  3 / 108 pts  (3%)

2 / 55 challenges patched

Per-challenge detail is withheld — it would reveal the rubric.

Commit: 8e1d9b2 · scoring run

🎉 Your result is on the leaderboard — see where you rank! 🏆