Downloaded 1,289 times
![Actual use case
$sql = “SELECT * FROM ARTICLES WHERE id = “ . $_GET[“id”];
//executed query - SELECT * FROM ARTICLES WHERE ID = 1234
$result = mysql_query($sql);
5](https://image.slidesharecdn.com/sqlinjection-120704012741-phpapp02/85/Sql-Injection-attacks-and-prevention-5-320.jpg)
![SQL injected input
$sql = “SELECT * FROM ARTICLES WHERE id = “ . $_GET[“id”];
//executed query - SELECT * FROM ARTICLES WHERE ID = 1234; DROP
TABLE ARTICLES
$result = mysql_query($sql);
6](https://image.slidesharecdn.com/sqlinjection-120704012741-phpapp02/85/Sql-Injection-attacks-and-prevention-6-320.jpg)
![Escape & Validate input
• Escape all input
– Whether supplied via the URL or via POST data
– Even for internal APIs
– Anything that goes to the DB is escaped
• Validate all input - Validating a Free Form Text Field for
allowed chars (numbers, letters, whitespace, .-_)
– ^[a-zA-Z0-9s._-]+$ (Any number of characters)
– ^[a-zA-Z0-9s._-]{1-100}$ (This is better, since it limits this
field to 1 to 100 characters)
• source https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
15](https://image.slidesharecdn.com/sqlinjection-120704012741-phpapp02/85/Sql-Injection-attacks-and-prevention-15-320.jpg)
![Actual use case
$sql = “SELECT * FROM ARTICLES WHERE id = “ . $_GET[“id”];
//executed query - SELECT * FROM ARTICLES WHERE ID = 1234
$result = mysql_query($sql);
5](https://image.slidesharecdn.com/sqlinjection-120704012741-phpapp02/75/Sql-Injection-attacks-and-prevention-5-2048.jpg)
![SQL injected input
$sql = “SELECT * FROM ARTICLES WHERE id = “ . $_GET[“id”];
//executed query - SELECT * FROM ARTICLES WHERE ID = 1234; DROP
TABLE ARTICLES
$result = mysql_query($sql);
6](https://image.slidesharecdn.com/sqlinjection-120704012741-phpapp02/75/Sql-Injection-attacks-and-prevention-6-2048.jpg)
![Escape & Validate input
• Escape all input
– Whether supplied via the URL or via POST data
– Even for internal APIs
– Anything that goes to the DB is escaped
• Validate all input - Validating a Free Form Text Field for
allowed chars (numbers, letters, whitespace, .-_)
– ^[a-zA-Z0-9s._-]+$ (Any number of characters)
– ^[a-zA-Z0-9s._-]{1-100}$ (This is better, since it limits this
field to 1 to 100 characters)
• source https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
15](https://image.slidesharecdn.com/sqlinjection-120704012741-phpapp02/75/Sql-Injection-attacks-and-prevention-15-2048.jpg)
More Related Content
Similar to Sql Injection attacks and prevention
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Sql Injection attacks and prevention
- 1. SQL Injection Anand Jain @helloanand Tech at Network18 1
- 2. What is it? SQLInjection allows a programmer user specified query to execute in the database 2
- 3. Excuse me, WHAT? Unintended SQL queries run in the DB Most of the times it also alters the original query 3
- 4. see how ithappens we 4
- 5. Actual use case $sql= “SELECT * FROM ARTICLES WHERE id = “ . $_GET[“id”]; //executed query - SELECT * FROM ARTICLES WHERE ID = 1234 $result = mysql_query($sql); 5
- 6. SQL injected input $sql= “SELECT * FROM ARTICLES WHERE id = “ . $_GET[“id”]; //executed query - SELECT * FROM ARTICLES WHERE ID = 1234; DROP TABLE ARTICLES $result = mysql_query($sql); 6
- 7. Ok, but… How willthe attacker know what I’ve named my table? 7
- 8.
- 9. There are queriesfor that too… http://www.site.com/articles.php ?id=1234 UNION SELECT group_concat(schema_name),2,3,4, 5,6,7,8,9,10,11,12,13,14,15,16,1 7,18,19,20,21,22,23,24 from information_schema.schemata -- 9
- 10. There are queriesfor that too… http://www.site.com/articles.php ?id=1234 UNION SELECT group_concat(table_name),2,3,4,5 ,6,7,8,9,10,11,12,13,14,15,16,17 ,18,19,20,21,22,23,24 from information_schema.tables where table_schema=database()-- 10
- 11.
- 12. SQL Attack steps •Searching for a vulnerable point • Fingerprinting the backend DB • Enumerating or retrieving data of interest – table dumps, usernames/passwords etc. • Eventual exploiting the system once the information is handy – OS take over, data change, web server take over etc. 12
- 13. It is avery serious problem • The attacker can delete, modify or even worse, steal your data • Compromises the safety, security & trust of user data • Compromises a company’s competitiveness or even the ability to stay in business 13
- 14. How to mitigatethe risk • Escape all user supplied input • Always validate input • Use prepared statements – For PHP+MySQL – use PDO with strongly typed parameterized queries (using bindParam()) • Code reviews • Don’t store password in plain text in the DB – Salt them and hash them 14
- 15. Escape & Validateinput • Escape all input – Whether supplied via the URL or via POST data – Even for internal APIs – Anything that goes to the DB is escaped • Validate all input - Validating a Free Form Text Field for allowed chars (numbers, letters, whitespace, .-_) – ^[a-zA-Z0-9s._-]+$ (Any number of characters) – ^[a-zA-Z0-9s._-]{1-100}$ (This is better, since it limits this field to 1 to 100 characters) • source https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet 15
- 16. Least privilege • Tominimize the potential damage of a successful SQL injection attack, you should minimize the privileges assigned to every database account in your environment. • Do not assign DBA or admin type access rights to your application accounts. • Don't run your DBMS as root or system! 16
- 17. URL rules • Noparentheses or angular brackets in the URLs – While saving or generating remove from the URLs – If you really need to have parentheses or angular brackets in the URL, then encode them • URL should not end with two or more dashes “--“ – While saving or generating remove these from the URLs • URL should not end with “/*” – While saving or generating remove these from the URLs • No schema, table or column names should be part of your URL • These rules should be followed even for AJAX/JSON URLs 17
- 18. Quick fixes • Forcompanies that have a large setup or a lot of legacy code that will take a long time to audit and fix, put some SQL injection detection patterns in your Load Balancer itself • Enable mod_security on Apache • Run the RIPS scanner on your PHP code for detecting vulnerabilities - http://sourceforge.net/projects/rips-scanner/ 18
- 19. Common (My)SQL injectionURL patterns • ending with “--” • ending with “/*” • containing UNION, (ALL), SELECT and FROM • BENCHMARK • Containing “information_schema” • Containing “load_file” 19
- 20. Further reading • SQLattacks by example - http://www.unixwiz.net/techtips/sql- injection.html • OWASP - https://www.owasp.org/index.php/SQL_Inject ion 20
- 21.