SQL Injection

SQL injection is a technique where malicious users inject SQL commands into an SQL statement via web page input. Injected commands can alter the SQL statement and compromise the security of a web application.

Web applications commonly build SQL statements by concatenating user input:

txtUserId = getRequestString("UserId")
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId

Always-True Injection

1=1 is always true. A malicious txtUserId such as 105 or 1=1 turns the query into:

SELECT UserId, Name, Password FROM Users WHERE UserId = 105 or 1=1

Valid syntactically, and returns every row in Users instead of one.

The same pattern applies to string comparisons. Injecting " or ""=" into both a username and password field:

SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

Batched Statement Injection

Batched SQL statements are separated by a semicolon. Injecting a second statement after the intended one:

SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers

Returns the requested row, then executes the injected DROP TABLE, deleting the Suppliers table.