166 terms · 75/46/45
Threat № 039 · class: applications

SQL Injection

SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.

Term

description · examples · notes

SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.

Description

The consequences depend on how badly protected the application is. Sometimes the attacker only reads data they should not see. Sometimes they bypass the login, change the contents of the database or delete records. And if the account the application uses to reach the database holds too many rights, one malicious input can become a large incident.

SQL injection is an old, well-known ailment, and still alive. It survives not because it is mysterious but because the same lapses repeat: queries assembled by hand, weak testing, over-broad rights on the database account, and applications that show their errors to the user. Parameterized queries are not an elegant detail but basic hygiene.

Examples

  • A search field returns data the user should not be able to see, because the application builds the input straight into the SQL query.
  • The attacker changes the login logic so that the application accepts an account without recognizing the password.
  • Blind SQL injection pulls data out of the database slowly, character by character, through differences in the application's responses.

Notes

  • SQL injection is not solved by filtering out a few dangerous characters, but by parameterized queries and correct handling of the database.
  • If the account the application uses to reach the database has over-broad rights, the consequences of an injection become far larger than they need to be, or ever should be.

Mentioned in the news

Composite
Wikipedia

Techniques

carried out with 4

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 7