|
|
|
No messages were posted in the selected interval. You might like to contact Administrator to start a new blog/thread/post. Or, try looking @
.Here is the last post:
|
|
Monday, March 03
|
SQL injection is a technique that exploits a security
vulnerability occurring in the database layer of an application.
The vulnerability is present when user input is either incorrectly
filtered for string literal escape characters embedded in SQL
statements or user input is not strongly typed and thereby
unexpectedly executed. It is in fact an instance of a more general
class of vulnerabilities that can occur whenever one programming
or scripting language is embedded inside another.
Forms of
SQL injection vulnerabilities
Incorrectly filtered escape
characters
This form of SQL injection occurs when user input
is not filtered for escape characters and is then passed into a SQL statement.
This results in the potential manipulation of the statements performed on
the database by the end user of the application.
The following line
of code illustrates this vulnerability:
statement :=
"SELECT * FROM users WHERE name = '" + userName + "';"
This SQL code is designed to pull up the records of a specified username
from its table of users, however, if the "userName" variable is crafted
in a specific way by a malicious user, the SQL statement may do more
than the code author intended. For example, setting the "userName"
variable as
a' or 't'='t
renders this SQL
statement by the parent language:
SELECT * FROM users
WHERE name = 'a' OR 't'='t';
If this code were to be
used in an authentication procedure then this example could be
used to force the selection of a valid username because the evaluation
of 't'='t' is always true.
On some SQL servers such as MS
SQL Server any valid SQL command may be injected via this method,
including the execution of multiple statements. The following value
of "userName" in the statement below would cause the deletion of
the "users" table as well as the selection of all data from the "data"
table (in essence revealing the information of every user):
a';DROP TABLE users; SELECT * FROM data WHERE name LIKE '%
This input renders the final SQL statement as follows:
SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM DATA
WHERE name LIKE '%';
Other SQL implementations won't
execute multiple commands in the same SQL query as a security measure.
This prevents hackers from injecting entirely separate queries, but
doesn't stop them from modifying queries.
Enforcing the
Use of Parameterized Statements
There are two ways to
ensure an application is not vulnerable to SQL injection: using
code reviews (which is a manual process), and enforcing the use
of parameterized statements. Enforcing the use of parameterized
statements means that SQL statements with embedded user input
is rejected at runtime. Currently only the H2 Database Engine
supports this feature.
|
|
Post your own comment
|
|
0
comment(s):-
|
|
|
|
|
|
|
|
