What is SQL injection??

[gsandip]

Hi ,


What is SQL injuction ??

[lordspace]

Hi,

the correct word is: 'injection'

check this resource:
http://en.wikipedia.or g/wiki/SQL_injection

Svet

[ronverdonk]

Since this is a pure SQL question I have moved it to the MySQL forum.

moderator

Most Web applications interact with a database, and the data stored therein frequently originates from users. Thus, when creating an SQL statement, a developer may use client data in its construction. A typical SQL injection attack exploits this scenario by attempting to send valid SQL as unexpected values of GET and POST data. This is why an SQL injection vulnerability is almost always the fault of poor data filtering ...............

See also the complete article by Chris Shiflett at Security Corner: SQL Injection

Ronald :cool:

[b1randon]

Since this is a pure SQL question I have moved it to the MySQL forum.

moderator


See also the complete article by Chris Shiflett at Security Corner: SQL Injection

Ronald :cool:

To boil it down to it's simplest terms it is when a user puts in input that contains SQL (i.e. puts password "pass' OR 1=1") in hopes that when this is combined with a sql statement like:

$sql = 'SELECT count(*) FROM users WHERE name = $name AND password = $pass';

This could result in the sql being

SELECT (*) FROM users WHERE name = 'brando' AND password = '' OR 1=1

Now if the user and pass don't match you SHOULD get 0 rows, but since there was sql injection you'll now always get all of the rows and possibly gain access to a site you shouldn't.

[ronverdonk]

Just to add to b1randon's post:
Imagine what happens if you prompt for a userid to get that particular user's row deleted! And someone specifies, when prompted for the userid: '123 OR 1=1'
The resulting MySQL statement would then be:

DELETE FROM table WHERE userid=123 OR 1=1;

effectively deleting all the rows in the table.

Ronald :cool:

[b1randon]

Just to add to b1randon's post:
Imagine what happens if you prompt for a userid to get that particular user's row deleted! And someone specifies, when prompted for the userid: '123 OR 1=1'
The resulting MySQL statement would then be:

DELETE FROM table WHERE userid=123 OR 1=1;

effectively deleting all the rows in the table.

Ronald :cool:

Ohhh very evil Ron! I like it >:)

[ronverdonk]

Just see what you could do with financial software, like updating a bank account!

Ronald :cool:

[tolkienarda]

seeing as were talking about sql injection there's a problem i've been having. someone is accessing one of my sites just to mess around and cause trouble and i've added the add slashes command but he is now using hex values to bypass that. but i don't know exactly how that works so if someone know how hex sql injection works could you tell me so i can learn how to prevent it.

example here is the hex for 1'or'1'='1

%31%27%6f%72%27%31%27%3d%27%31

thanks all

[ronverdonk]

seeing as were talking about sql injection there's a problem i've been having. someone is accessing one of my sites just to mess around and cause trouble and i've added the add slashes command but he is now using hex values to bypass that. but i don't know exactly how that works so if someone know how hex sql injection works could you tell me so i can learn how to prevent it.

example here is the hex for 1'or'1'='1

%31%27%6f%72%27%31%27%3d%27%31

thanks all

Since I do not know what your input data is and what data type, I must guess.

Most important is to know what your data is. If you do an operation on a numeric field, just test if the field is numeric before you use it. And then check the maximum value. Or force it to be numeric with the type cast like [php]$uid=int ($uid);[/php]. A cast forces PHP to perform a type conversion. If the input is not entirely numeric, only the leading numeric portion is used. If it starts with alpha or is all-alpha the conversion results in 0. So this is very effective with numeric fields.

If you use a char field, enclose it in single quotes and escape it.

Ronald :cool:

[Killer42]

Is there such an expression as "SQL injunction"?

I was asked about this via PM recently, but told the person to post the question in a forum. That may or may not have been the souirce of this thread.

[ronverdonk]

Is there such an expression as "SQL injunction"?

I was asked about this via PM recently, but told the person to post the question in a forum. That may or may not have been the souirce of this thread.

No, this thread's title was indeed 'What is SQL injunction'. I changed that title to the current one to avoid confusion.

Ronald :cool:

[Killer42]

No, this thread's title was indeed 'What is SQL injunction'. I changed that title to the current one to avoid confusion.

Ah! I see the source of the problem now. I still have the PM, and on re-reading, it actually says "How to protect the PHP code from SQL Injuction attacks". :)

I read this as a mis-typed injunction.

[ronverdonk]

What is one character more or less among friends?

Ronald :cool:

[kalpit]

Hi ,


What is SQL injuction ??

Hi Sandip,

Following link will give you basic information of injection in mysql...

http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

[ronverdonk]

Hi Sandip,

Following link will give you basic information of injection in mysql...

http://www.tizag.com/mysqlTutorial/m...-injection.php

Thanks kalpit and welcome to The Scripts!. That is a very useful tutorial.

Ronald :cool: