SQL Injection and Oracle, Part Two December 4, 2002[From
SecurityFocus] SQL Injection is a way to attack the data in a
database through a firewall protecting it. It is a method by
which the parameters of a Web-based application are modified in
order to change the SQL statements that are passed to a database
to return data. For example, by adding a single quote (') to the
parameters, it is possible to cause a second query to be
executed with the first. SQL injection techniques are an
increasingly dangerous threat to the security of information
stored upon Oracle Databases. These techniques are being
discussed with greater regularity on security mailing lists,
forums, and at conferences. There have been many good papers
written about SQL Injection and a few about the security of
Oracle databases and software but not many that focus on SQL
injection and Oracle software. This is the second part of a two-
part article that will examine SQL injection attacks against
Oracle databases. The first installment offered an