SQL Injection | SQLi Tutorial - Tpoint Tech

1. SQL Injection (SQLi) www.tpointtech.com

2. What is SQLi? SQL Injection (SQLi) is a malware attack in which attackers inject malicious code into an application, by which attackers are allowed to read or modify a database.

3. SQL injection generally occurs when we ask a user to input their username/userID. Instead of a name or ID, the user gives us an SQL statement that we will unknowingly run on our database.

4. Example of SQL Injection We have an application based on EMPLOYEE records. An employee can view only their own records by entering a unique and private employee ID. We have a field like EMPLOYEE_ID and PASSWORD to enter the details. EMPLOYEE_ID: 236893238 PASSWORD: mypassword SELECT * FROM EMPLOYEE WHERE EMPLOYEE_ID = 236893238 AND PASSWORD = 'mypassword';

5. SQL Injection Attack Suppose a malicious user enters the following input: EMPLOYEE_ID: '''' OR 1=1 PASSWORD: '''' OR 1=1 1.SELECT * FROM EMPLOYEE WHERE EMPLOYEE_ID = '''' OR 11=1 AND PASSWORD = '''' OR 11=1; This query is logically always true, so the 1=1 will return all records for which this holds. All the employee data has been compromised; now, the malicious user can view all records, delete records, or modify employee records.

6. SQL injection based on Batched SQL statements If an attacker inputs the following statements: 1.SELECT * FROM Employee; 2.DROP TABLE Employee_Add; This SQL statement will first return all rows from the Employee table and then delete the Employee_Add table.

7. Types of SQL injection

8. Harms of SQL injection

9. How to Detect SQL Injection?

10. For the prevention of SQL injection, we can utilize the following techniques.

11. Use Parameterized Queries Parameterized queries are also called prepared statements. It is a cost-effective way to prevent SQL injection. It works by separating the SQL code from the user input. In this technique, we do not build SQL queries by concatenating them but use placeholders.

12. Input Validation and Whitelisting In the input validation, it accepts the data after checking and restricting user input to match the expected format before use in the database. A username should only consist of letters and numbers. An email must match the pattern of a valid email address. Whitelisting allows only known, safe values or formats and rejects everything else.

13. Use Object Relational Mapping (ORM) Frameworks ORM frameworks help to prevent the SQL injection. They can automatically generate safe and parameterized queries. In this technique, developers interact with the database using objects, classes, and methods. ORM handles input and query construction.

14. Limit Database Permissions In the Limit Database Permissions, we only give access to the user if they absolutely need to perform their task. If an attacker wants to perform any SQL injection attack, it damages only databases that are connected to the user. When the user has full admin access, the attacker can drop tables or access sensitive data. But if the access is limited. It reduces the risk of injection.

15. Use Web Application Firewalls (WAFs) Firewalls are the application tools that protect the application by monitoring and filtering incoming traffic on the website. It works like a protective shield between the internet and the application. It automatically blocks malicious requests, cross-site scripting, and other attacks. It inspects HTTP requests in real-time, detects suspicious input or patterns and blocks attack methods & bots. It gives immediate protection without changing the code.

16. We provides tutorials and interview questions of all technology like java tutorial, android, java frameworks Contact info: G-13, 2nd Floor, Sec-3, Noida, UP, 201301, India hr@tpointtech.com +91-9599086977 Follow us