What is a SQL injection attack?

The articles written on this blog were created with the goal of teaching. Also, the information in the article may be incorrect, so please be careful.

If a website pastes user input into an SQL statement, the user can enter SQL syntax rather than data. This vulnerability is called SQL Injection.

A common SQL attack often refers to SQL injection. To be precise, attacks on systems that use SQL are a broader term, and the representative input attack is SQL injection.

Problems that arise when combining strings as is

Let's say you created the login code as follows:

const sql =
    "SELECT * FROM users WHERE name = '" + userName +
    "' AND password = '" + password + "'";

When normal input is received, the following SQL is created.

SELECT * FROM users
WHERE name = 'rose' AND password = '1234';

However, if quotation marks and SQL operators are included in user input, the structure of the sentence intended by the developer may change.

' OR 1=1 --

SELECT * FROM users
WHERE name = '' OR 1=1 -- ' AND password = '';

1=1is always true,--The latter can be commented out. Strings that should have been treated only as data have become part of SQL commands.

What damage does it cause?

Even though SQL injection is possible, the same damage does not always occur. Results vary depending on the type of database you are running, account permissions, and the range of statements that can be executed at once.

Still, in general, the following problems may occur:

• Bypass login checks.
• Read other users' personal information.
• Change or delete posts or account information.
• Use error messages to determine the database structure.
• If the database account permissions are too high, the scope of damage becomes wider.

Front-end inspection alone cannot prevent it.

You can think it's safe because your browser blocks entering quotation marks. However, an attacker can send an HTTP request directly to the server without going through the browser screen.

Therefore, input length limits and screen inspection are only aids for usability. The real defense must be done on the server running SQL.

The core cause of SQL injection is not a single special character. The fundamental problem is mixing user data and SQL commands into one string.