Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have a PHP site hosted on Apache and someone hacks it using SQL injection, is there a way I can find out exactly which script caused this by looking at my web server logs?
Or using some other way?

share|improve this question
up vote 0 down vote accepted

If your web server logs are logging the query parameters, then search for known SQL (e.g. SELECT) through the logs.

If they're not logging query parameters, then you're unlikely to find anything by searching the logs, rather you'll have to look for patterns - for example a repeated URL that wouldn't normally be repeated.

share|improve this answer
Ok this brings me to another question. How do you log query parameters? – Frank Martin Apr 11 '13 at 3:10
One more thing. Shall I look into access logs or error logs? – Frank Martin Apr 11 '13 at 3:17
The error logs should show failed hack attempts, not successful ones. So start with the access logs. To see how to change what's getting logged, maybe making a separate log for query parameters only, look at . – Jenny D Apr 11 '13 at 7:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.