Q:

Is a server susceptible to SQLi if it does not accept user input?

My SQLite3 and PHP webpage does not accept user inputs, only uses PHP to build tables for connecting users to read. Is my page susceptible to SQLi from any other means as there is no user input fields or log-in?

A:

SQL injection will only exist if you have user input that manipulates SQL queries in your PHP code. If you have no forms or do not make use of any other way that alters any SQL query in your scripts, you should be fine.

