What is SQL Injection? A Very Simple Guide

Imagine you're at a restaurant. You tell the waiter your order, and they pass it on to the chef. Now, imagine someone changes your order before it reaches the chef. Instead of getting your favorite dish, you get something completely different. This is similar to what happens with SQL injection in websites.

What is SQL Injection?

SQL injection is a trick that attackers use to make websites do things they aren’t supposed to do. They sneak in harmful commands to get access to the website's database, which can hold a lot of important information.

How Does SQL Injection Work?

• To understand how SQL injection works, let’s first look at a simple example of a legitimate SQL query:

Imagine the `users` table in the database looks like this:

| id  | username | password |
| --- | -------- | -------- |
| 1   | rahul    | india123 |
| 2   | priya    | delhi456 |
| 3   | arjun    | mumbai789|

• A user tries to log in with the username 'rahul' and the password 'india123'. Normally, the website checks if your details are correct with a command like this:

SELECT * FROM users WHERE username = 'rahul' AND password = 'india123';

• This query checks if there is a user with the username 'rahul' and the password 'india123' in the `users` table. Now, suppose an attacker enters the following input instead of a regular username and password:

username: ' OR '1'='1
password: ' OR '1'='1

The resulting SQL query becomes:

SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '' OR '1'='1';

• Since `'1'='1'` is always true, this query would return all the records in the `users` table, effectively bypassing authentication and granting the attacker access to sensitive data.

After the SQL injection, the attacker can see all the rows:

| id  | username | password |
| --- | -------- | -------- |
| 1   | rahul    | india123 |
| 2   | priya    | delhi456 |
| 3   | arjun    | mumbai789|

Types of SQL Injection

1. Simple SQL Injection: Attackers put harmful commands into input fields like login forms or search boxes.
2. Blind SQL Injection: Attackers don't see direct results but guess the database structure by watching how the website reacts.
3. Error-based SQL Injection: Attackers make the website show error messages that reveal database information.
4. Union-based SQL Injection: Attackers use a special command to get data from different parts of the database.

Why is SQL Injection Bad?

• Data Breaches: Attackers can see private information like addresses and credit card numbers.
• Data Loss: Attackers can delete or mess up data, causing big problems for businesses.
• Reputation Damage: People lose trust in companies that get hacked.
• Financial Losses: Fixing these problems can cost a lot of money.

How to Prevent SQL Injection

1. Use Prepared Statements

• Prepared statements are a way to keep your SQL commands and data separate. This makes it hard for attackers to sneak in harmful code. For example, in PHP:

$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);

2. Check and Clean Input

• Make sure all user input is checked and cleaned before using it in commands.

3. Use Stored Procedures

• Stored procedures are pre-written SQL commands that are safer to use.

4. Handle Errors Carefully

• Don’t show detailed error messages to users. Instead, use simple messages and log the details for developers.

5. Regular Security Checks

• Regularly test your website for security issues to find and fix problems early.

6. Limit Database Access

• Give your database accounts only the permissions they need. This way, even if an attacker gets in, they can’t do too much damage.

Conclusion

SQL injection is a trick that attackers use to make websites do things they aren’t supposed to do. They sneak in harmful commands to get access to the website's database, which can hold a lot of important information. By understanding how it works and implementing robust security measures, developers and organizations can protect their applications and data from malicious attacks. Remember, security is not a one-time effort but an ongoing process that requires vigilance and continuous improvement.

Stay safe, and happy coding!

Connect with me on LinkedIn:

LinkedIn

Resources used to write this blog:

• Learn from YouTube Channels
• OWASP: SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
• SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
• PHP Prepared Statements: https://www.php.net/manual/en/mysqli.prepare.php
• SQLMap: http://sqlmap.org/
• I used Google to research and resolve my doubts
• From my Experience
• I used Grammarly to check my grammar and use the right words.

if you enjoy reading my blogs, consider subscribing to my feeds. also, if you are not a medium member and you would like to gain unlimited access to the platform, consider using my referral link right here to sign up.

Visit us at DataDrivenInvestor.com

Subscribe to DDIntel here.

Join our creator ecosystem here.

DDI Official Telegram Channel: https://t.me/+tafUp6ecEys4YjQ1

Follow us on LinkedIn, Twitter, YouTube, and Facebook.