SQL Injection

SQL Injection: what it is, why it works and how to prevent it - SQL Magazine 23

Facebook Twitter

 (4) (0)

This article teaches about SQL Injection which is an attack class where the attacker can insert or manipulate queries created by the application, which are sent directly to the relational database.

SQL Injection, what is it?

Safety has always been and will be a topic that worries us all, whether at home, on the streets or at work. When we speak of computer security, there is not a single department of a single company that does not have this concern as well. If we question security with developers and DBAs, the concern will be even greater, since these two departments are mainly responsible for the applications that the companies offer in the local network (intranet), or global (internet). There are several objects of this concern, but there is a relatively old theme, unknown to many, but with devastating potential when exploited: SQL Injection, which will be the subject of this matter.

Platform used

SQL Injection is an attack technique based on the manipulation of SQL code, which is the language used to exchange information between applications and relational databases. Since most software makers use the SQL-92 ANSI standard (see Note 1) in writing the SQL code, the security issues and failures presented here apply to every environment that makes use of this standard for information exchange - the which includes, for example, Oracle servers. In this article we used servers from the Microsoft platform: Internet Information Server, Active Server Pages and Microsoft SQL Server.