lecture recording on 11 December 2024 at 10.34.54 AM

Introduction to SQL Injection

• SQL Injection: A form of attack that allows an attacker to interfere with the queries an application makes to its database.

How Normal Login Works

• The web application attempts to authenticate users by checking usernames and passwords against a database table called users.

• If the credentials match, access is granted; if not, a message prompts the user to re-enter their credentials.

SQL Injection Scenario

• Performing SQL Injection

  • User enters a username (e.g., Jason) and attempts to log in.

  • Instead of a normal password, an attacker inputs: \' OR 1=1;.

• SQL Statement Generation

  • The application generates an SQL query: SELECT * FROM users WHERE username='Jason' AND password='\' OR 1=1;'

  • The SQL command attempts to find records with username

    • If true (1 equals 1), the query is always true regardless of the password.

• Result of Injection

  • This manipulation tricks the application into granting access without the correct password, bypassing authentication controls.

Why SQL Injection is Dangerous

• Alters standard query flow, allowing unauthorized access to user accounts.

• Security implications include data breaches and unauthorized operations in the database.

Prevention Strategies

• Input Validation

  • Validate all user inputs to detect and reject harmful characters (like \).

  • An application should never trust user inputs, particularly for database queries.

• Use of Least Privilege

  • Implement permissions carefully so that no application has higher access than necessary.

• General Advice for Developers

  • Always validate and sanitize input to mitigate risks of SQL and other code injections (e.g., HTML, XML).

Recognizing SQL Injection in Examinations

• Look for patterns like OR 1=1, which when present, indicate SQL injection attempts.

  • Any constant true statement (e.g., 7=7, 123=123) points to potential SQL attack vectors.

• Key Takeaway: Input validation is paramount to safeguarding applications against SQL injection and should be mandatory in coding practices.