SQL Injection

1
SQL Injection

• Vulnerability of web applications

2
Whats SQL Injection?

• Technique for exploiting web applications that
  use client-supplied data
• Stripping of potentially harmful characters is
  missing
• Simple to prevent, but number of vulnerable
  services is still astonishing

3
Authorization Bypass

• SQLQuery "SELECT Username FROM Users WHERE
  Username " strUsername " AND Password
  " strPassword "
• strAuthCheck GetQueryResult(SQLQuery)
• If strAuthCheck "" Then boolAuthenticated
  FalseElse boolAuthenticated TrueEnd If
• Example

4
Break out of quotes
query SELECT CompanyName FROM Shippers WHERE
ID id
Unchecked user input
query SELECT CompanyName FROM Shippers WHERE
ID 0 UNION ALL SELECT CompanyName FROM
Customers