SQL Injection
SQL Injection
com
THE WORLD'S LARGEST WEB DEVELOPER SITE
HTMLCSSJAVASCRIPTSQLPHPBOOTSTRAPHOW
TOPYTHONMORE EXERCISES REFERENCES
SQL Tutorial
SQL HOMESQL IntroSQL SyntaxSQL SelectSQL Select DistinctSQL WhereSQL And, Or,
NotSQL Order BySQL Insert IntoSQL Null ValuesSQL UpdateSQL DeleteSQL Select TopSQL
Min and MaxSQL Count, Avg, SumSQL LikeSQL WildcardsSQL InSQL BetweenSQL
AliasesSQL JoinsSQL Inner JoinSQL Left JoinSQL Right JoinSQL Full JoinSQL Self JoinSQL
UnionSQL Group BySQL HavingSQL ExistsSQL Any, AllSQL Select IntoSQL Insert Into
SelectSQL CaseSQL Null FunctionsSQL Stored ProceduresSQL Comments
SQL Database
SQL Create DBSQL Drop DBSQL Backup DBSQL Create TableSQL Drop TableSQL Alter
TableSQL ConstraintsSQL Not NullSQL UniqueSQL Primary KeySQL Foreign KeySQL
CheckSQL DefaultSQL IndexSQL Auto IncrementSQL DatesSQL ViewsSQL InjectionSQL
Hosting
SQL References
SQL KeywordsMySQL FunctionsSQL Server FunctionsMS Access FunctionsSQL OperatorsSQL
Data TypesSQL Quick Ref
SQL Injection
❮ PreviousNext ❯
SQL Injection
SQL injection is a code injection technique that might destroy your database.
SQL injection is one of the most common web hacking techniques.
SQL injection is the placement of malicious code in SQL statements, via web
page input.
Example
txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;
The rest of this chapter describes the potential dangers of using user input in
SQL statements.
If there is nothing to prevent a user from entering "wrong" input, the user can
enter some "smart" input like this:
105 OR 1=1
UserId:
Does the example above look dangerous? What if the "Users" table contains
names and passwords?
SELECT UserId, Name, Password FROM Users WHERE UserId = 105 or 1=1;
A hacker might get access to all the user names and passwords in a database,
by simply inserting 105 OR 1=1 into the input field.
Username:
John Doe
Password:
myPass
Example
uName = getRequestString("username");
uPass = getRequestString("userpassword");
sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' +
uPass + '"'
Result
SELECT * FROM Users WHERE Name ="John Doe" AND Pass ="myPass"
Password:
The code at the server will create a valid SQL statement like this:
Result
SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""
The SQL above is valid and will return all rows from the "Users" table, since OR
""="" is always TRUE.
The SQL statement below will return all rows from the "Users" table, then delete
the "Suppliers" table.
Example
SELECT * FROM Users; DROP TABLE Suppliers
Example
txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;
Result
SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers;
SQL parameters are values that are added to an SQL query at execution time,
in a controlled manner.
The SQL engine checks each parameter to ensure that it is correct for its
column and are treated literally, and not as part of the SQL to be executed.
Another Example
txtNam = getRequestString("CustomerName");
txtAdd = getRequestString("Address");
txtCit = getRequestString("City");
txtSQL = "INSERT INTO Customers (CustomerName,Address,City)
Values(@0,@1,@2)";
db.Execute(txtSQL,txtNam,txtAdd,txtCit);
Examples
The following examples shows how to build parameterized queries in some
common web languages.
txtUserId = getRequestString("UserId");
sql = "SELECT * FROM Customers WHERE CustomerId = @0";
command = new SqlCommand(sql);
command.Parameters.AddWithValue("@0",txtUserID);
command.ExecuteReader();
txtNam = getRequestString("CustomerName");
txtAdd = getRequestString("Address");
txtCit = getRequestString("City");
txtSQL = "INSERT INTO Customers (CustomerName,Address,City)
Values(@0,@1,@2)";
command = new SqlCommand(txtSQL);
command.Parameters.AddWithValue("@0",txtNam);
command.Parameters.AddWithValue("@1",txtAdd);
command.Parameters.AddWithValue("@2",txtCit);
command.ExecuteNonQuery();
❮ PreviousNext ❯
COLOR PICKER
HOW TO
Tabs
Dropdowns
Accordions
Side Navigation
Top Navigation
Modal Boxes
Progress Bars
Parallax
Login Form
HTML Includes
Google Maps
Range Sliders
Tooltips
Slideshow
Filter List
Sort List
SHARE
CERTIFICATES
HTML
CSS
JavaScript
PHP
jQuery
Bootstrap
XML
Read More »
REPORT ERROR
PRINT PAGE
FORUM
ABOUT
Top Tutorials
HTML Tutorial
CSS Tutorial
JavaScript Tutorial
How To Tutorial
W3.CSS Tutorial
Bootstrap Tutorial
SQL Tutorial
PHP 5 Tutorial
PHP 7 Tutorial
jQuery Tutorial
Python Tutorial
Top References
HTML Reference
CSS Reference
JavaScript Reference
W3.CSS Reference
Bootstrap Reference
SQL Reference
PHP Reference
HTML Colors
jQuery Reference
Python Reference
Angular Reference
Top Examples
HTML Examples
CSS Examples
JavaScript Examples
How To Examples
W3.CSS Examples
Bootstrap Examples
PHP Examples
Python Examples
jQuery Examples
Java Examples
XML Examples
Web Certificates
HTML Certificate
CSS Certificate
JavaScript Certificate
jQuery Certificate
PHP Certificate
Bootstrap Certificate
XML Certificate
Get Certified »