What is SQL Injection & How to Prevent SQL Injection

What Is SQL Injection?

SQL Injection is a code-based vulnerability that allows an attacker to read and access sensitive data from the database. Attackers can bypass security measures of applications and use SQL queries to modify, add, update, or delete records in a database. A successful SQL injection attack can badly affect websites or web applications using relational databases such as MySQL, Oracle, or SQL Server. In recent years, there have been many security breaches that resulted from SQL injection attacks.

With this basic understanding of ‘what is SQL Injection’, you will now look at the different types of SQL Injection.

Become a Certified Ethical Hacker!

CEH v12 - Certified Ethical Hacking CourseExplore Program

Demo on SQL Injection

• Go to Google Chrome or any web browser and search for owasp broken web apps
• Click on the sourceforge.net link
• Select the Download option to download the OWASP Broken Web Applications Project

This application has been developed by the Open Web Application Security Project that periodically releases the top 10 risks that an application will face for a particular year. It has a collection of vulnerable web apps that are distributed on a Virtual Machine. 

This project has in-built vulnerabilities for learners and professionals to practice and develop their skills on how SQL injection works. 

Note: Performing SQL Injection in the real-world on any website is illegal.

• After downloading the OWASP Broken Web Apps virtual machine, open it on a VMware workstation.
• You can see the IP address of the machine. In this case, it’s 192.168.71.132

• Use the IP address mentioned above and open it on a browser

You will find training applications, and realistic, intentionally vulnerable applications.

You can also find old versions of real applications and much more.

For the demonstration, you’ll be using the OWASP Mutillidae II application.

On the left, you can see the OWASP top 10 risks for 2013, 2010, and 2007. 

Click on SQLi - Bypass Authentication > Login

You will enter a regular login authentication page that any application may ask for.

Suppose you enter an anonymous username and password, that won’t allow you to log in.

Let’s write an SQL statement in the username and try to login again.

• My Username will be: ‘ or 1=1 -- 
• Click on Login
• You will log in this will time with a status update saying it has authenticated the user

The single quote (‘) is an operator that goes to the database server, selects the default user tables, and compares it to the condition that is given. That condition that you gave was 1=1, which is always true. So, it selected the default user table that was available in the database, and instead of comparing it to a password, it compared it to the condition.

If you give a false condition like 1=2, you will get an error message “Account does not exist”.

Now, that you have looked at a demonstration on how an SQL query can be used to login to an application, let’s understand the last topic in this article on ‘what is SQL Injection’.

Become a Certified Ethical Hacker!

CEH v12 - Certified Ethical Hacking CourseExplore Program

How to Prevent SQL injection?

1. Use prepared statements and parameterized queries - Parameterized statements ensure that the parameters passed into the SQL statements are treated safely.
2. Object-relational mapping - Most development teams prefer to use Object Relational Mapping frameworks to translate SQL result sets into code objects more seamlessly. 
3. Escaping inputs - It is a simple way to protect against most SQL injection attacks. Many languages have standard functions to achieve this. You need to be aware while using escape characters in your code base where an SQL statement is constructed. 

Some of the other methods used to prevent SQL Injection are:

• Password hashing
• Third-party authentication
• Web application firewall
• Purchase better software
• Always update and use patches
• Continuously monitor SQL statements and database