{"id":30,"date":"2011-07-01T11:00:24","date_gmt":"2011-07-01T11:00:24","guid":{"rendered":"https:\/\/sqlserverlearner.azurewebsites.net\/2011\/07\/01\/sql-injection\/"},"modified":"2011-07-01T11:00:24","modified_gmt":"2011-07-01T11:00:24","slug":"sql-injection","status":"publish","type":"post","link":"https:\/\/sqlserverlearner.com\/2011\/07\/01\/sql-injection\/","title":{"rendered":"SQL injection"},"content":{"rendered":"

SQL injection<\/strong>
\nSQL injection is technique that exploits a security vulnerability using sql code.
\nThis happens when the input given by the user is not correctly checked for the vurnerable SQL code and is there by sent to the instance of SQL Server for parsing and execution. This process works by terminating the text and by appending a new command.<\/p>\n

SQL Injection Attack is abbreviated as SQLIA<\/strong><\/p>\n

Basic example of SQL Injection attack:<\/strong><\/p>\n

Lets consider the following query:<\/p>\n

[php]var sql = "SELECT * FROM EMPLOYEE WHERE NAME =’"+EmployeeName+"’";[\/php]<\/p>\n

EmployeeName is fetched from the users input from the web page.<\/p>\n

Now if the user enters “Jhon”, then the query would run great and the details of “Jhon” would be displayed.<\/p>\n

But consider user entering the following as input:
\n[php]’ or ‘1’=’1[\/php]<\/p>\n

This would result in the following query:<\/p>\n

[php]var sql = "SELECT * FROM EMPLOYEE WHERE NAME =” or ‘1’=’1’";[\/php]<\/p>\n

This means the user will be able to tweek the SQL query.<\/p>\n

Using such means users can by pass user authentication on the websites. Hence the developers must be careful in order to avoid such Injection attacks.<\/p>\n

Now if we pass this as employee name??
\n[php]Jhon’; drop table EMPLOYEE–[\/php]<\/p>\n

This results in the query being built into:
\n[php]var sql = "SELECT * FROM EMPLOYEE WHERE NAME =’Jhon’; drop table EMPLOYEE–‘";[\/php]<\/p>\n

The SQL Query that would be executed will be:
\n[sql]SELECT * FROM EMPLOYEE WHERE NAME =’Jhon’; drop table EMPLOYEE–‘[\/sql]<\/p>\n

Here ; says that the first query is completed, and the — says to ignore the remaining part of the query.<\/p>\n

So three queries are executed here:
\n[sql]
\nSELECT * FROM EMPLOYEE WHERE NAME =’Jhon’
\ndrop table EMPLOYEE
\n–‘[\/sql]<\/p>\n