SQL Injection

After a long time I thought I should write something in the blog. Today we will talk about SQL Injection.

SQL Injection is a bit old but still useful web hacking technique.As the name implies this involves injecting a malicious SQL code into the SQL database through a user input field provided to us on a website.

This can be used not only to gain access to the site using the mechanism but also to play with the database and destroy it.

For a example, let's take a simple website with user login.It has two input fields to get a username and a password.What happens in this case is that when we enter the username and password, it goes to the back end and run a  SQL Query to check whether user name and password is correct. if its correct the query return true state and Then we get access to the site or if the username or password in the database does not match or False tells us that the site can not be logged in. That is simply the story behind the scenes.

So in this case the attacker is trying to make it True somehow by injecting the SQL code through the input file field.

This is how it happens.

SELECT * FROM users WHERE user_name='$user_name' AND password='$password'

This is the query to check if the relevant raw is present in the database.So in this case the username and password that we use in the login are set to $ user_name and $ password.

That means we can only change these two places as an input.

Now suppose we type 'OR 1 = 1 #' in the username field.when it comes to  $username 

SELECT * FROM users WHERE user_name=''OR 1=1 #AND password='$password'

that's how it comes. lets see what is happened now.user name is replaced as a empty string by the single quote that we were sent, as user_name=''.Then there is an OR gate in this so we know that the result will be True if only one side is True.

Then 1 = 1 is always true so the result is always true.Because of the next # simble, the whole query written after that will be a comment.Now since OR has 1 = 1, this is true anyway.So this works and the relevant person gets access to the site.

Most of the new websites now, have these stopped.They filtered all user inputs well.But for some web sites may it works still.But trying to using these things are illegal this article is only for educational purposes.Do not get to troubles by doing those things.if you want to try just make a simple page in your personal server or local host to test.

see you with another article soon !