‫To understand Eskew, well, injection, we should know basic terms of the database systems first.
‫A database is an organized collection of data.
‫It is a collection of schemas, tables, queries, reports, views and other objects.
‫A database management system, DB MS is a computer software application that interacts with end users,
‫other applications and the database itself to capture and analyze data.
‫A general purpose BMS allows the definition, creation, querying, update and administration of databases.
‫Well-known database management systems include Oracle may ask, you will ask you all server, PostgreSQL,
‫etc. Structured query language SQL is a language used in programming and designed for managing data
‫held in a relational database management system.
‫R.D. Beams SQL became a standard of the ANC American National Standards Institute in 1986.
‫And of the ISO International Organization for Standardization in 1987.
‫Since then, the standard has been revised to include a larger set of features.
‫Despite the existence of such standards, though, most sequel code is not completely portable among
‫different database systems without adjustments.
‫Here there is a select query example, the school select statement returned a result set of records
‫from one or more tables.
‫A select statement retrieves zero or more rose from one or more database tables or database views,
‫select is the most commonly used data query language or dick you will command.
‫In the example shown on the slide, we have a table named client.
‫Client Table has four fields name, surname, age and gender.
‫There are four records in the client table.
‫In the select sentence.
‫We want name and the surname fields of the client table records.
‫Where the value of the age field of the records is greater than 30.
‫So the result of this select sentence will be the name and surname values of these two records.
‫There are a lot of code injection vulnerabilities as a result of the input and output manipulation,
‫such as operating system, code injection, XML injection, HTML script injection, object injection
‫now the most famous code injection is sequel injection as you well, injection is used to attack data
‫driven applications in which nefarious squirrel statements are inserted into an entry field for execution.
‫For example, to dump the database contents to the attacker as well, injection must exploit a security
‫vulnerability in an application software.
‫For example, when a user input is either incorrectly filtered for string literal escape characters
‫embedded in SQL statements or user input is not strongly typed and unexpectedly executed in the fuel
‫injection scenario.
‫The parameter, which is used to produce unexpected results, is sent to the server.
‫The parameter is not sanitized adequately.
‫On the server side, the server prepares the sequel string, which will cause the unexpected result
‫and sends it to the database management server, and the result is returned to the web server.
‫The web server processes the query result, prepares a response and sends it to the user.
‫Eskew L Injection attacks allow attackers to spoof identity.
‫Tamper with existing data such as voiding transactions or changing balances.
‫Allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable.
‫And become administrators of the database server.