What is SQL injection attack?

The technique of SQL injection started around 1990’s. SQL stands for Structured Query Language which is the common language for database. SQL injection was first used to attack secure website by injecting SQL codes into the web application form.

By doing so, the attacker was able to spoil the design of website. Later many attackers started using it to crack database contents by bypass authentication. Most hackers use this technique because it lets them break through the website security and to perform data theft.

Now days, things had been change, today there are a lot of security check that site builder are using to ensure that their site is safe against SQL injection, well noting is 100% secure, but there is a lot more awareness for this subject, and site owners and site builder doing the best they can to save their data.

An SQL injection> works towards efficiently exploiting web application information through bypassing its authentication credentials. In most cases, a web application requires a login process to the application prior to getting access to the secured information and to other features of the site.

Whenever user tries to perform a login action, for example, he or she is actually transmitting information such as username along with passwords and other data to the web server, in the web server a web application, service, server site script or control panel receives this sensitized information to further process the command, most of the time against a database.

However, if the user is unauthorized then he or she receives a failure message, and needs to re-login with correct credentials as stored inside the database.

This can be the step that the user uses a SQL injection technique to rescue the login credentials bypassing the authentication process and manage to gain access to the website.

A traditional way to check if it is possible to attack a website with SQL injection is by simply placing a single inverted comma after the URL tag of the website. If the website shows an error such as ‘not found’ then it may be protected from SQL injection. However, if you find the URL redirecting to parking pages showing crack in codes, then it means you can hack it.

An example of SQL injection flow:

1. User has to set user name and password to log into a site.
2. In the user name the attacker set the following line: ‘name OR 1=1 — ‘
3. The code that processes the request does not check for ‘problematic’ characters.
4. The SQL that run will check if the user name is equal to name or if 1=1 which is true – 1 is equal 1
5. The – tag in MS SQL is a code for remark or comment so every thin that is after this tag will be ignore and treated as remark and will not be check.
6. SQL will return that the user name and password are match… that it, you gain access into the system.

PHP code example:


$user=$_POST["username"];

$pass=$_POST["userpass"];

$query = "SELECT * FROM users WHERE user_name='".$user."' AND user_pass='".$pass."';";

This code can cause an injection, there is no check to the received data from the user.

So if the user set the user name with the 1=1 there is no check for the input and that we will have a SQL injection example.

This traditional SQL injection technique was used for years until developers became more aware of the problematic thing that is cause. They decided to “join forces” by building additional secure technologies to ensure that module in web site, services and other application that involve with user data and database are performing extra user data validation . The terror of the above method of SQL injection continued to be one of the most effective website hacking techniques in our decade. I do hope that you can’t but I do believe that this technique might still work on some of the site.

In order to try and prevent SQL injection if you are a developer or you are someone that have web base application learn about the types of SQL injection attack and keep on to follow up to date information to implement and to update if needed location in your application that might safer from SQL injection.

There are a lot of code sample over the net that can help the process of developing sections in most types of application and web base sites that already checked against several types of SQL injections by using this code you can make it more secured and more safe against SQL attacks, just keep in mind that most of the code maintain by people and it is updated from time to time, so you should also update your site code with new code that probably contains list of fixed bugs and also might contain new features.