sql injections

From what I understand, Yii was set up to prevent sql injections due to model posting. However, when running an Acunetix scan on my site (development mode), it is claiming a successful injection on our registration page (email form input). I can’t replicate the error (ie, the form correctly has an error validation since the sql injection is not valid email address). Has anyone experienced this or can comment on Yii as relates to SQL injections if we are using the Yii framework standard model->table mapping, so no actual SQL commands in our code)? Thanks.

its will be better if you will show us some code that its "injectable"

This is what the Acunetix report shows. To be clear, I haven’t been able to replicate the injection myself, so trying to understand how/why Acunetix can do it.




Details

/testit2/index.php

URL encoded POST input User%5bemail%5d was set to 'and(select 1 from(select count(*),concat((select

concat(CHAR(52),CHAR(67),CHAR(117),CHAR(71),CHAR(89),CHAR(51),CHAR(119),CHAR(106),CHAR(71),CHAR(80

),CHAR(48)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by

x)a)and'

Injected pattern found: 4CuGY3wjGP0



and




POST /testit2/index.php?r=user/create HTTP/1.1

Content-Length: 745

Content-Type: application/x-www-form-urlencoded

Cookie: PHPSESSID=s5ncs4pfvtr3oj4ctcoacu24i6;

YII_CSRF_TOKEN=5684b2bfe32559cd77f958683dd8b7c6afed5246s%3A40%3A%224fb7cac0c60f6fe3bd94a

729d74e3e78410cd9c0%22%3B

Host: www.XXXXXXXX.com

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Accept: */*

(line truncated)

...0%29%2cCHAR%2848%29%29%20from%20information_schema.tables%20limit%200%2c1%29%2cfloor%

28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29and%27

Request headers

&User%5bFirstName%5d=wutvuaog&User%5bLastName%5d=wutvuaog&User%5bpassword_unhash%5d=wutv

uaog&User%5bpassword_unhash_repeat%5d=wutvuaog&User%5bschoolType%5d=C&User%5btermagree%5

d=0&User%5btransType%5d=B&User%5busername%5d=wutvuaog&User%5bverifyCode%5d=wutvuaog&YII_

CSRF_TOKEN=4fb7cac0c60f6fe3bd94a729d74e3e78410cd9c0&yt0=Sign Up!



ok, can you show us the code that you programed? now from the software but the relevant php code