SQL injection

The structured query language (SQL) is an ANSI standard language for accessing data from a relational database. SQL is commonly used to process user-supplied data from web pages and applications on the server side. SQL injection is a technique for inserting SQL commands as user input. If these are not properly filtered for escape character and commands, as attacker can potentially append data and commands to an SQL query, which many force the server to send back sensitive information, overwrite other user’s data on the server, or execute server commands.

The problem stems from the fact that SQL commands on a web server are typically constructed based on data received from users. As an example, consider a log-in mechanism in which usernames and passwords are stored in a database and a query is constructed based on authentication information supplied by a user on a web form. An example of such a string constructed on an active server page (ASP) may be

      QueryName = “select username from

authenticationtable where username = ‘ ” &

request.form(“name”) &  “ ’password = ‘ ” &

request.form(“password”) & “ ‘ ”

In the query above, if a valid username / password combination is entered, the name of that authenticated user is stored in the variable queryname. One simple check to see whether the username / password combination is valid is to check to see whether this variable contains any data. If it contains a nonempty string, the user is granted access and that user’s credentials are forwarded on. One easy way to subvert such a mechanism is to change the query to

      Select username from authenticationtbale where true

Which will result in the first username in the table being stored in the variable queryname. This can be accomplished by entering.

     Username           : ‘ or ‘1’ = ‘1

      Password            : ‘ or ‘1’ = ‘1

This will force everything after the where clause to equate to true and return the first name in the table to the variable queryname. 

There are many other tricks you can try with SQL injection. For example, many SQL commands are passed from page to page or the server using get. Get exposes data in the browser’s URL, which is then easily modified by an attacker. If you are testing any web-based applications or an application that send commands to a database, you need to try SQL injection attacks, or hackers will do it for you.