SQL-Injection derives from the possibility of injecting malicious data into the form of SQL
code using any input channel such as querystring parameters sent via get HTTP method or fields of a
data entry form sent via post. The malicious sql code changes server side, the legitimate query that the
programmer wanted to do on the DBMS. By means of sql injection
an attacker can even go so far as to recall system stored procedure and therefore directly interact
with the server hosting the web application or the DBMS.
The slide scenario illustrates the possibility for an attacker to bypass a possible login page by exploiting
a vulnerability of SQL injection.
As you can see, by injecting a malicious input an sql query is created that allows an attacker
to bypass the login page.
The attack techniques of sql injection can make use of operators such as the union operator to determine
queries completely under the control of the attacker, as can be seen in the current slide.
Among the best remedies to counter SQL injection is to create parametric server side queries,
avoiding to concatenate the data from inputs with constant pieces of sql. In the slide
We see an example of a parametric query created in Java.
Let's see the continuation of the parametric query example in Java.
Here is also an example in C Sharp of parametric query to avoid vulnerabilities of SQL injection.
Here is where ADO.Net-based parametric query is created and executed, incidentally, if Linq to
Entities or Linq to a SQL is used to query databases
the problem of SQL injection does not exist.
And here is another example of mitigation using a parametric query in a PHP Web application.
Some in-depth links on the SQL injection vulnerability.
We can see here a list of best practices taken from the OWASP secure coding guidelines about DBMS
security. For example, use a least privilege policy when accessing the database, or do not leave
the connectionstring authentication credentials hardcoded in the source code.
Some other best practices on database security, such as disabling any unused DB default accounts.
Thank you so much for your kind
attention