SQL Injection

Introduction

SQL injection (SQLi) is a type of cyberattack that exploits vulnerabilities in applications and websites using SQL databases. By injecting harmful SQL code into existing SQL queries through input fields, attackers can gain unauthorized access to sensitive data such as customer records, intellectual property, and personal information.

These attacks can affect any system that relies on SQL databases, including websites, desktop applications, and mobile apps, often leading to significant consequences. Through SQLi, attackers can discover admin credentials, alter database information, perform admin-level tasks on the database, retrieve system files, and even execute commands on the underlying operating system.

Due to the severe impact of SQLi attacks, it is essential for developers to implement robust security practices. Preventative measures include using parameterized queries, stored procedures, and thorough input validation to protect applications from such vulnerabilities.

How Does SQL Injection Work?

SQL injection attacks usually exploit input fields on web pages or applications, such as search boxes, form fields, and URL parameters. Attackers start by identifying vulnerabilities within the web page or application. Once a target is found, they craft malicious payloads and input content designed to execute harmful commands. Sometimes, attackers use automated programs to perform SQL injections. By providing the target website’s URL, these programs can automatically extract stolen data from the victim.

Example of SQL Injection Attack

Consider a simple login form on a website where users enter their username and password to authenticate:

$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) > 0) {
   // User authenticated successfully
   // Proceed to logged-in area
} else {
   // Authentication failed
   // Show error message
}

1. Normal Scenario:

• The PHP code above fetches the username and password from a form submission ($_POST[‘username’] and $_POST[‘password’])
• It then constructs an SQL query ($sql) to check if a user with the provided credentials exists in the users table of a database.

The query is supposed to fetch user data where both username and password match the inputs.

2. SQL Injection Exploitation Scenario:

• An attacker can exploit the following code if it’s vulnerable to SQL injection. For example, instead of entering a valid username and password, they might enter something like:

username: admin' --
password: anything

• When the attacker submits above values, the SQL query becomes:

SELECT * FROM users WHERE username = 'admin' --' AND password = 'anything'

This SQL injection example shows how attackers can manipulate input fields to bypass authentication, gaining unauthorized access to a system.

‍