Ideally, all values of one column are unique statements are created dynamically using and form an identifier/key. In relational user input, hackers can use the same input database structure, this unique identifier form to inject SQL commands. This attack is will be present in all tables and will gather really easy to realize and the consequences together the different tables4. This unique are severe. They can have access to data identifier is the primary key of the table. To registered inside as well as modify or delete link two tables, the primary key attributes of them. All websites including forms are likely the first table must appear in second one to be attacked by SQL injection. and are referred to as a foreign key. Unlike For example, if a website is protected by a primary key values, a foreign key value can login and a password, an evil person can appear several times in a table. enter in the username form a string like ‘OR A view is a virtual table consisting of 1=1 --, then he will gain the access to the selected rows and columns from one or protected website without having a valid more tables. It doesn’t actually exist in the password or username. database, but is created at the time of the Before the injection, the SQL code was close request. From a security point of view, a to: view can limit access to a relational database by hiding parts of the database SELECT * FROM LoginTable from certain users. WHERE UserName=‘content of username box‘ In order to query and manipulate data in AND Password=‘content of relational database, a basic syntax language password box‘; The injection turns the code into: has been created: Structure Query Language SELECT * FROM LoginTable (SQL). WHERE UserName = OR 1=1 -- ‘ ’ ‘ AND Password = ’ ’; Database Vulnerability: SQL Injection 1=1 is always true and the comment mark - - will terminate prematurely the text string and the following text will be ignored by the Databases are increasingly exposed to server at execution time. Thus the password security threats. will not be checked. SQL injection The main goal of this attack is to extract a According to the Imperva Web Application large amount of data. The solution against Attack Report, SQL injection attacks (SQLi) SQLi is input validation. were the prevalent attacks in 20145. This attack takes advantages of web applications coding weaknesses. In fact, if SQL
Ideally, all values of one column are unique and form an identifier/key. In relational database structure, this unique identifier will be present in all tables and will gather together the different tables4. This unique identifier is the primary key of the table. To link two tables, the primary key attributes of the first table must appear in second one and are referred to as a foreign key. Unlike primary key values, a foreign key value can appear several times in a table. A view is a virtual table consisting of selected rows and columns from one or more tables. It doesn’t actually exist in the database, but is created at the time of the request. From a security point of view, a view can limit access to a relational database by hiding parts of the database from certain users. In order to query and manipulate data in relational database, a basic syntax language has been created: Structure Query Language (SQL). Database Vulnerability: SQL Injection Databases are increasingly exposed to security threats. SQL injection According to the Imperva Web Application Attack Report, SQL injection attacks (SQLi) were the prevalent attacks in 20145. This attack takes advantages of web applications coding weaknesses. In fact, if SQL statements are created dynamically using user input, hackers can use the same input form to inject SQL commands. This attack is really easy to realize and the consequences are severe. They can have access to data registered inside as well as modify or delete them. All websites including forms are likely to be attacked by SQL injection. For example, if a website is protected by a login and a password, an evil person can enter in the username form a string like ‘OR 1=1 --, then he will gain the access to the protected website without having a valid password or username. Before the injection, the SQL code was close to: SELECT * FROM LoginTable WHERE UserName=‘content of username box‘ AND Password=‘content of password box‘; The injection turns the code into: SELECT * FROM LoginTable WHERE UserName = ‘ ’ OR 1=1 -- ‘ AND Password = ’ ’; 1=1 is always true and the comment mark - - will terminate prematurely the text string and the following text will be ignored by the server at execution time. Thus the password will not be checked. The main goal of this attack is to extract a large amount of data. The solution against SQLi is input validation.
201603-Technical-Database-Security.docx