How SQL injections work, and how to protect your system from them.

[Cpvr]

How SQL injections work, and how to protect your system from them.

SQL injection is a type of attack where the attacker runs damaging SQL commands by inserting malicious SQL code into an application input field or URL.

For example, imagine an app that returns all your information after logging in. That query may look like the following:

SELECT * FROM users
WHERE username = 'USER_INPUT';

If an attacker were to submit a malicious input, the query could change to the following:

SELECT * FROM users
WHERE username = '' OR '1'='1';

This query will return all users as '1'='1' will always return true.

You can protect your system from SQL injection by doing the following:

1. Use prepared statements or parameterized queries:

User input cannot be executed because prepared statements and parameterized queries ensure a distinct separation between user input and SQL code.

2. Validate and clean inputs:

Use expected formats and constraints to validate user input, and clean inputs to get rid of characters that may be interpreted as SQL code.

3. Follow the least privilege principle:

Limit the permissions for database accounts used by applications and services to only what is required for their functionality. This limits the system's vulnerability to SQL injection attacks.

4) Set Web Application Firewalls (WAF)

By setting up WAFs, common threats and attacks from HTTP/S traffic like SQL injections can be identified and blocked before they ever reach your application.

 

[Tyrsson]

I can see WAF as an issue depending on the user input. A single quote can be valid user input, but if you filter that at the WAF then the user input is either A) Incomplete or B) Never reaches the application.