‫So here there's a typical sequel injection example.
‫We are in an online shopping site and would like to see a laptop.
‫The URL for the laptop can be seen on the slide.
‫The sequel query to bring the details of the laptop will be something like this with an unexpected parameter.
‫The skull query becomes just like this.
‫Now what if we tamper with the ID parameter and send the ID string like this?
‫OK, suppose that we have a method to authenticate user log in.
‫Now, it looks like Java code, but it's not.
‫It gives errors if you try to compile the method in any language.
‫Please just for now, focus on the algorithm.
‫The method takes username and password as a parameters and decides if the user can log into the application.
‫It returns true if the user is valid, otherwise it returns false.
‫So let's build the school query using the parameters which come from the log in form.
‫The single quotes.
‫Or to start and end the string values in a sequel, string plus signs are for the string concatenation.
‫School string is executed and corresponding records create the result set.
‫The method returns false if no records are found, otherwise returns true, and that's the user log
‫in.
‫If we enter user one as a username and one two three four is a password.
‫We ask you, Elstree will be select star from users where username equals user one and password equals
‫one two three four.
‫And the method will return true if there is a record matched, which means if there is a user named
‫user one and if this user's password is one two three four.
‫Now, suppose we enter one single quote or one equals one.
‫Double dash as a password.
‫Now, the sequel starring will be.
‫Select star from users where username equals user one and password equals.
‫One or one equals one double dash.
‫In SQL queries, double dash means that the rest of the line is the comment and will not be executed.
‫Here we use a double dash to get rid of the redundant single quote, since one equals one is always
‫true and the logical operator is or where clause will match for all the records of the user's table,
‫which means the size of the results set will be the total number of records in the table, and the method
‫will let us log in even though we don't know the password.
‫So let's make an SQL injection example.
‫So for this demo, we use them vulnerable web applications go to the OWASP Broken Web Applications Home
‫page.
‫Log in of the application using user user credential.
‫Go to SQL injection page.
‫Now on this page, when we submit the user ID, that user's name and surname are displayed, if we try
‫to submit a single quote with the ID number, we get a syntax error message and we see that the database
‫system is my you well.
‫And there is a redundant single quote in the actual string, which means our input is not sanitized
‫and a single quote has arrived in the database.
‫Now, if we succeed to create a valid SQL string, we may get the results of that query.
‫So let's submit this one single quote or one equals one double dash space.
‫The database system of the application my sequel requires space characters after the double dash, so
‫don't forget to put a space after the double dash.
‫And what do we have here?
‫Now we have the name and surname information of all records.