Sql injection Attack

Aatif Ali from Bangalore

What is SQL injection attack...?

Lost User

SQL Injection Attacks and Some Tips on How to Prevent Them[^]

Bastard Programmer from Hell :suss: If you can't read my code, try converting it here[^]

Richard Deeming

http://en.wikipedia.org/wiki/SQL_injection[^]

SQL injection is a technique often used to attack data driven applications. This is done by including portions of SQL statements in an entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database (e.g., dump the database contents to the attacker).

https://www.owasp.org/index.php/SQL_Injection[^]

A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

“That which can be asserted without evidence, can be dismissed without evidence.”

― Christopher Hitchens

Richard Deeming

Aatif Ali from Bangalore wrote:

How to avoid or prevent this attack...?

Use parameterized queries;
Don't use dynamic SQL, use parameterized queries;
Oh, and did I mention: use parameterized queries!

Input validation and other techniques have their place, but the only way to completely avoid SQL injection is to use parameterized queries. If you ever find yourself concatenating strings (other than known constant strings) to build a query, either in client code or a stored procedure, you've left yourself open to SQL injection.

"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer