Explain SQL Injection along with example?
SQL Injection attack with Example in Java. Let's see what is SQL Injection. How SQL Injection attack works. How to prevent SQL Injection. SQL Injection is code injection technique.
SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query. Injected SQL data alters the purpose of original query and upon execution can gives harmful result.
A SQL injection attack is very dangerous and attacker can,
1. Read sensitive data from the database.
2. Update database data (Insert/Update/Delete).
3. Slowdown the complete Database system etc.
Let's understand by taking one example, say you want to get user details, for that query will be,
"select * from user where username = ' " + username + " ' ";Is the above query complete and ready to execute? NO. there is dependency on user data.
username here is the placeholder, which is going to be replaced by actual user name of the person stored in our database.
We ask user to enter his/her username, which is going to fill our placeholder username.
Client
Lets take a input from user,
Enter your user name: ___________________
Do we have control on what user is going to fill in username? NO. say user entered,
1. user can fill name of animal and press submit (username = dog) or,
2. user can fill name of some hospital and press submit (username = apollo) or,
3. user can fill some junk data say $$##^^aahh* and press submit (username = $$##^^aahh*) or,
4. user can fill query like say username = jayesh'; delete from user where id='1 and press submit
(username = jayesh'; delete from user where id='1).
Server
Behavior of user input on server data
1. username = dog
Query will turn into,
select * from user where username='dog';
2. username = apollo
Query will turn into,
select * from user where username='apollo';
3. username = $$##^^aahh*
Query will turn into,
select * from user where username='$$##^^aahh*';
4. username = jayesh'; delete from user where id='1
Query will turn into,
select * from user where username='jayesh'; delete from user where id='1';
How our application will behave in above cases?
1. For Case 1, 2 and 3 it may or may not have harmful behavior but
2. For Case 4, it is sure that we are in trouble,
Appending user data to our query template, turned query template into 2 queries and our SQL
server engine will execute 2 queries separately.
1. Select Query.
select * from user where username='jayesh';
2. Delete Query (This query will delete user record, which was never intended.)
delete from user where id='1';
This indirect way of injecting SQL code inside the query is called SQL Injection.
SUMMARY
At server side, queries generally by themselves are not complete and require user data to make it complete, meaningful and executable.
"select * from user where username = ' " + username + " ' ";Above query is not complete as it has dependency on username variable.
Now if username variable is filled by third party, then there are chances that user data contains SQL,
Take an example. Application is asking user to enter user name,
Enter user name:________________________
Enter user name:___jayesh'; delete from user where id='1__
At Server Side,
username = "jayesh'; delete from user where id='1"
Final Query = "select * from user where username = ' jayesh'; delete from user where id='1 ' ";
If you observe final query, upon execution it will delete the record from user table which was never the purpose of original query and this is called SQL Injection attack.
Because of user data (which can be anything and uncontrolled) involvement in formation of query, SQL Injection attack can happen.
You may also like to see
How prepared statement prevents SQL Injection?
Count number of Bits to be flipped to convert A to B
Count number of Set Bits in Integer.
Check if number is Power of Two.
Find all subsets of a set (Power Set).
Skyline Problem in Java.
Find Minimum length Unsorted Subarray, Sorting which makes the complete array sorted
Count trailing zeros in factorial of a number
Enjoy !!!!
If you find any issue in post or face any error while implementing, Please comment.
No comments:
Post a Comment