What is SQL?
SQL (structured query language) is a language used for interacting with databases. Its functions include:
- Requesting (querying) data
- Adding new data
- Deleting data
It is often used with login forms to grant or deny user access to a system.
You will learn more about SQL in Unit 2.2.3 — Additional Programming Techniques
What is an SQL Injection?
An SQL injection is when a hacker enters a malicious SQL command into a form. When the data is passed to the database, the SQL command is processed and may grant access when it should be denied.
An SQL injection may allow an attacker to:
- Bypass authentication
- View confidential data
- Change data
- Delete data
- Modify or destroy the database structure
SQL Injection – An Example
-
A website has a login form
Normally, the user enters their details, such as a username and password.
-
The website sends an SQL query to the database
The details entered by the user are included in an SQL command and sent to the database.
The database checks its records. If a record with a matching username and password is found, access is granted to the user.
-
SQL injection
Instead of entering a username and password, an attacker enters a partial SQL command.
-
Malicious query
The partial SQL command forms part of the query to be sent to the database.
The modified query changes the meaning of it.
In this example, access will be granted if a username is blank OR if '1' = '1'.
-
A condition which is always True
Of course, '1' = '1' will always be True, so access is granted.
Preventing SQL Injection Attacks
Input validation checks whether the input is acceptable. Unacceptable input, such as an equals symbol, is rejected.
Input sanitisation removes or changes parts of the input which could be used in an attack.