{"id":1049,"date":"2020-06-05T13:48:06","date_gmt":"2020-06-05T13:48:06","guid":{"rendered":"https:\/\/sectigostore.com\/blog\/?p=1049"},"modified":"2020-11-03T16:35:03","modified_gmt":"2020-11-03T16:35:03","slug":"what-is-sql-injection-8-tips-on-how-to-prevent-sql-injection-attacks","status":"publish","type":"post","link":"https:\/\/sectigostore.com\/blog\/what-is-sql-injection-8-tips-on-how-to-prevent-sql-injection-attacks\/","title":{"rendered":"What Is SQL Injection? 8 Tips on How to Prevent SQL Injection Attacks"},"content":{"rendered":"\n

Akamai\u2019s State of the Internet report that analyzed data between November 2017 and March 2019 indicates that SQL injection now represents nearly <\/strong>two thirds (65.1%)<\/strong><\/a> of all web application attacks<\/strong><\/h2>\n\n\n\n

One of the most widespread attacks on web servers aims to attack their backend databases to reveal sensitive information such as customer details, company data, etc. Because the stakes are so high, regardless of whether you\u2019re an application owner or a regular user, addressing questions like \u201cwhat is SQL injection?\u201d or \u201cwhat are some of the most commonly used SQL injection types?\u201d will hopefully move us forward in the right direction to better understanding SQL injection attacks<\/a> are, how they work, and how to stop them.<\/p>\n\n\n\n

So, in this article, we\u2019ll discuss how to prevent SQL injection attacks once we have a better understanding of what constitutes this high-risk vulnerability.<\/p>\n\n\n\n

What Is SQL Injection and How Does It Work?<\/strong><\/h2>\n\n\n\n
\"What
This graphic represents how an SQL injection attack works.<\/figcaption><\/figure><\/div>\n\n\n\n

SQL (structured query language, pronounced \u201csequel\u201d or \u201cS-Q-L,\u201d depending on the user) injection attacks regularly show up on the OWASP vulnerabilities list<\/a> that reveals the top 10 web application security risks in the industry. SQLi attacks, as they\u2019re also known, rely on inadequate input validation checks that can be circumvented to execute a crafted query as a SQL command on the site\u2019s backend database.<\/p>\n\n\n\n

User-supplied data (a malicious string submitted as a search query) can be passed onto the backend database server. Without proper input validation checks, the query may get executed on the server. Apart from data security issues, attackers can exploit this vulnerability to delete tables and wreak havoc, severely disrupting your entire business operation. From verbose error messages that can inadvertently disclose helpful details to a potential attacker to sensitive data stored on the server getting leaked, SQL injection flaws can lead to undesirable and disastrous outcomes.<\/p>\n\n\n\n

Let\u2019s take a moment to understand what a typical SQL query looks like and how the database processes it. This will help you better understand what SQL injection is and how it works. For this example, imagine that there\u2019s an insecure e-commerce application with no defenses in place against SQL injection attacks. When a user attempts to log in, their browser requests the URL below:<\/p>\n\n\n\n

https://insecure-app.com\/login<\/code><\/pre>\n\n\n\n
The SQL query that runs on the backend database to log in the user after the credentials are submitted is shown below:<\/p>\n\n\n\n
SELECT * FROM Users WHERE username=\u2018admin\u2019 AND password=\u2019adminpass\u2019;<\/code><\/pre>\n\n\n\n
The asterisk symbol (*) indicates that all the columns from the table \u201cUsers\u201d will display if the login is successful. But now consider that an attacker tries to manipulate the database to log in as the admin user without knowing the password and enters the username as admin\u2019–:<\/strong><\/p>\n\n\n\n
SELECT * FROM Users WHERE username=\u2018admin\u2019--\u2019 AND password=\u2019passw0rd\u2019;<\/code><\/pre>\n\n\n\n
Using line comments (–) to trick the database into disregarding the remaining query to avoid filling out mandatory parameters or to dodge syntax errors is a common trick deployed in SQL injection attacks. The problem with the above query is that the database comments out the \u201cAND\u201d statement, which leads to the password parameter being ignored. An input parameter in a SQL statement acts like a placeholder to which data can be passed at runtime.<\/p>\n\n\n\n
So, how do we detect this vulnerability in our applications? Besides relying on manual testing, a common testing tool called sqlmap<\/a> can be used to identify and exploit six types of SQL injection vulnerabilities. Some other tools can also be used for detection, including:<\/p>\n\n\n\n