Website vulnerable to Blind SQL?

[polonus]

Given here: http://exposure.easyaudit.org/analysis/rahblog.ir
For that domain: https://www.virustotal.com/nl/domain/rahblog.ir/information/
Via php http://www.domxssscanner.com/scan?url=http%3A%2F%2Frahblog.ir%2Findex.php%3F2
http://www.domxssscanner.com/scan?url=http%3A%2F%2Frahblog.ir%2Findex.php%3F914
See: http://toolbar.netcraft.com/site_report?url=http://rahblog.ir
uMatrix has prevented the following page from loading:
-http://www.webgozar.ir/c.aspx?Code=2802291&t=counter
And consider: http://www.domxssscanner.com/scan?url=http%3A%2F%2FpiChaK.Net%2Fgoogle-plus%2Fcode.php%3Fb%3D7%26l%3D54
Protection: http://blog.codinghorror.com/give-me-parameterized-sql-or-give-me-death/

polonus

[polonus]

Another one: http://www.domxssscanner.com/scan?url=http%3A%2F%2Ffindnsave.siftingsherald.com%2F
http://exposure.easyaudit.org/analysis/findnsave.siftingsherald.com
http://toolbar.netcraft.com/site_report?url=http://findnsave.siftingsherald.com
Warnings: https://asafaweb.com/Scan?Url=findnsave.siftingsherald.com%2F’
Change sql statement to use rails helpers. … (closes issue ASTERISK-19192) Reported by: Tyuta Vitali - - * Fix blind transfers … (stable) - API 1.7.7 (stable) - Updated LICENSE file - Version 1.7.12 (stable) - API 1.7.7 . on nginx/1.7.12
also OpenSSL vulnerability CVE-2010-4180.
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a “plaintext command injection” attack, a similar issue to CVE-2011-0411.

polonus