SQL Injection Attacks: How to be Aware?

What is an SQL injection attack?

A SQL injection attack exploits a vulnerability in a web application, allowing hackers to change the queries being conducted on the underlying database. Web applications that immediately execute user inputs as queries are vulnerable to SQL injections. This enables attackers to run malicious queries, sometimes known as malicious payloads, on database servers.

SQL Injection: A Simple Example

To explain this issue, Let's create a table "tbluser" to describe the SQL Injection Attack.

Create table tbluser
(
 userName varchar(50) primary key,
 userpwd varchar(50),
 address varchar(100)
 )
insert into tbluser(userName,userpwd,address)values('mohan@gmail.com','123456','Delhi');
insert into tbluser(userName,userpwd,address)values('shailendra@gmail.com','123456','Noida');
insert into tbluser(userName,userpwd,address)values('jitendra@gmail.com','123456','Gurgaon');
insert into tbluser(userName,userpwd,address)values('bipul@gmail.com','123456','Delhi');
select * from tbluser 

Now let’s look at the following query string in Asp.net. In this we are passing username from TextBox "txtUserID" and userpwd from TextBox "txtpwd" to check user credentials.

"SELECT * FROM tbluser WHERE userName = '"+ txtUserID.text +"' and userpwd = '"+ txtPwd.text +"'"; 

Now hacker will pass the following input to TextBoxes to inject sql attack. What will happen when the below data goes as input?

"SELECT * FROM tbluser WHERE userName = ';Drop table tblusers --' and userpwd = '123'"; 

The semicolon; in the above statement will terminate the current sql. So, "SELECT * FROM tbluser WHERE UserID = ''" will become a separate statement, and after Semi Colon; it will start a new sql statement "Drop table tblusers" that will drop our table tbluser. Hence your user details table has been dropped and your database will be unmanaged.

How Does a SQL Injection Attack Work?

SQL injection attacks work by injecting malicious code into input fields, like login forms or search boxes.

SELECT * FROM Users WHERE Username = 'inputUsername' AND Password = 'inputPassword';

An attacker could input:

Username: admin' --

This modifies the query to bypass authentication:

SELECT * FROM Users WHERE Username = 'admin' --';

Real-Life SQL Injection Attack Examples

Examples of major SQL injection attacks include:

• Heartland Payment Systems (2008): Over 130 million credit card numbers were stolen.
• Sony Pictures (2011): Confidential data was leaked, including customer information.
• TalkTalk (2015): A data breach exposed sensitive information of over 150,000 customers.

Breaches Enabled by SQL Injection

SQL injection attacks have led to significant data breaches and financial loss for several organizations. Proper coding practices are essential to prevent these breaches.

Notable SQL Injection Vulnerabilities

• Unsanitized user inputs
• Dynamic SQL queries without parameterization
• Exposed error messages that reveal database structure

Types of SQL Injection Attacks

• In-band SQL Injection (Classic SQLi): Using the same channel for injection and data retrieval.
• Inferential SQL Injection (Blind SQLi): Gathering information by analyzing server responses without seeing the data directly.
• Out-of-Band SQL Injection: Using different channels to retrieve data.

SQL Injection Code Examples

Example 1: Using SQLi to Authenticate as Administrator

Username: ' OR 1=1 --

This input bypasses the password check by always evaluating the condition as true.

Example 2: Using SQLi to Access Sensitive Data

Username: ' UNION SELECT CreditCardNumber, ExpiryDate FROM CreditCards --

This input extracts credit card details from another table using the UNION keyword.

Example 3: Injecting Malicious Statements into Form Fields

Username: '; DROP TABLE Users --

This query deletes the entire Users table.

SQL Injection Prevention

• Use Parameterized Queries/Prepared Statements: Separate user input from the SQL query.
• Use Stored Procedures: Avoid dynamically building SQL queries.
• Validate User Input: Always validate and sanitize input data.
• Apply Least Privilege Principle: Ensure application accounts have minimal database access.
• Hide Error Messages: Don’t expose detailed error messages to users.
• Deploy Web Application Firewalls (WAFs): Block SQLi attacks in real time.