HI,
What is SQL injection?
Thanks.
Loading
Know the answer? Post it — somebody with the same question will find it here.
Sign in to answer this question
It is the same account you read, post and publish with — and you will come straight back to this page.
Jignesh TrivediPosted Jan 19, 2012, 11:07 PM
A SQL injection attack is exactly what the name suggests – it is where a hacker tries to "inject" his SQL code into someone else's database, and force that database to run his SQL. This could potentially ruin their database tables, and even extract valuable or private information from their database tables. The idea behind SQL injection is to have the application under attack run SQL that it was never supposed to run.
for example
The SQL that would retrieve the email address in the "email me my password" form would typically look something like this:
SELECT data FROM table WHERE Emailinput = '[email protected]';
if this malicious code is run by the application under attack, it would look like this:
SELECT data
FROM accounts
WHERE Emailinput = 'Y';
UPDATE accounts
SET email = '[email protected]'
WHERE email = '[email protected]';
hope this help.
Hemant KumarPosted Jan 19, 2012, 7:15 AM
SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker.
The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed. A less direct attack injects malicious code into strings that are destined for storage in a table or as metadata. When the stored strings are subsequently concatenated into a dynamic SQL command, the malicious code is executed.
The injection process works by prematurely terminating a text string and appending a new command. Because the inserted command may have additional strings appended to it before it is executed, the malefactor terminates the injected string with a comment mark "--". Subsequent text is ignored at execution time.
http://msdn.microsoft.com/en-us/library/ms161953.aspx
http://www.cgisecurity.com/questions/sql.shtml