SQL injection prevention techniques

SQL injection prevention techniques

1. SQL injection prevention techniques EGCO 627: Web Penetration Testing Mahidol University

2. What is SQL injection ? An SQL injection is a technique that attackers apply to insert SQL query into input fields to then be processed by the underlying SQL database. These weaknesses are then able to be abused when entry forms allow user-generated SQL statements to query the database directly . “OR 1=1”

3. What is SQL injection? (Cont.) To give you a typical scenario, take a typical login form consisting of a user/email field and a password field. After the login info is submitted, it is combined with an SQL query on your web server. In PHP, the command is written in the following way:

4. What is SQL injection? (Cont.) It is sent to the server to verify if it was given a valid username with a corresponding password. A username “ admin ” with the “ admin1234 ” password would result in this command:

5. What is SQL injection? (Cont.) It will then return user data that was entered in the password field. This move could allow the login screen to be bypassed. An attacker can also go further by adding another select condition, ‘ OR 1=1 ’, that will result in the following query :

6. What is SQL injection? (Cont.) พิสูจน์ ตัวตนปกติ พิสูจน์ ตัวตน SQLi

7. SQL Injection - Information Gathering (Cont . ) So I browsed it and I could see this :

8. SQL Injection - burp suite scan

9. SQL Injection Authentication Bypass Cheat Sheet or 1=1 or 1=1-- or 1=1# or 1=1/* ' or ' 1 ' = ' 1 admin' -- admin' # admin'/* admin' or '1'='1 admin' or '1'='1'-- admin' or '1'='1'# admin' or '1'='1'/* admin' or 1=1 admin' or 1=1-- admin' or 1=1# admin' or 1=1/* admin') or ('1'='1 admin') or ('1'='1'-- admin') or ('1'='1'# admin') or ('1'='1'/* admin') or '1'='1 admin') or '1'='1'-- admin') or '1'='1'# admin') or '1'='1'/* https ://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet /

10. How to prevent SQL injection attacks SQL injections are one of the most utilized web attack vectors, used with the goal of retrieving sensitive data from organizations . When you hear about stolen credit cards or password lists, they often happen through SQL injection vulnerabilities. Fortunately, there are ways to protect your website from SQL injection attacks.

11. SQL injection preventaion techniques Escaping Always use character-escaping functions for user-supplied input provided by each database management system (DBMS). This is done to make sure the DBMS never confuses it with the SQL statement provided by the developer .

12. SQL injection preventaion techniques (Cont.) For example, use the mysql_real_escape_string () in PHP to avoid characters that could lead to an unintended SQL command. A modified version for the login bypass scenario would look like the following :

13. SQL injection preventaion techniques (Cont.) Previously, your code would be vulnerable to adding an escape character (\) in front of the single quotes. However, having this small alteration will protect against an illegitimate user and mitigate SQL injection.

14. SQL injection preventaion techniques (Cont.) Prepared  Statements Parameterized queries are a means of pre-compiling a SQL statement so that you can then supply the parameters in order for the statement to be executed. This method makes it possible for the database to recognize the code and distinguish it from input data.

15. SQL injection preventaion techniques (Cont.) Stored procedures Stored procedures (SP) require the developer to group one or more SQL statements into a logical unit to create an execution plan. Subsequent executions allow statements to be automatically parameterized. Simply put, it is a type of code that can be stored for later and used many times.

16. SQL injection preventaion techniques (Cont.) Escaping Always use character-escaping functions for user-supplied input provided by each database management system (DBMS). This is done to make sure the DBMS never confuses it with the SQL statement provided by the developer.

17. SQL injection prevention techniques (Cont.)   input user มาสร้าง query แล้วยิงลง database ตรงๆ โดยไม่มี escape ใดๆ

18. SQL injection prevention techniques (Cont.) Escape user input