What is a SQL Injection Attack

hi,

SQL injection is an attack in which wicked code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically correct queries that it receives.
 

For example

String orderNumer = Request.QueryString["MyTest"]

I will pass Query String "MyTest" to "AA001" Then Query:

String sql = "Select * from Orders where number ='"+ orderNumer + "'

// Actual Query : Select * from Orders where number = 'AA001'

Now some user pass data in "MyTest" Query String "AA001' ;Delete From Order - -"

Actual Query: Select * from Orders where number = 'AA001'; Delete From Order - -'

hope this help.

The sql injection is passing some destructive commands to the sql server while passing the query process statements.

For example when you try to do DML statements from the front end (search the text), web site hackers used to pass the DROP, TRUNCATE, DELETE.

For example, when you try to search some thing in the text box

string strquery = "SELECT * FROM Employees WHERE employeeName LIKE '''+txtSearch.Text+"'";

here hackers used to pass some thing like
jack;'DROP TABLE employees

it will be two set of statement to execute. It will be done in the sql server.

It can be overcommed using the stored procedure.


I suggest you to go through the below urls:
http://www.unixwiz.net/techtips/sql-injection.html
http://msdn.microsoft.com/en-us/library/ms161953.aspx

Please check this link:

http://en.wikipedia.org/wiki/SQL_injection