SQL Injection

Vulnerability that occurs when an application incorporates user input directly into the SQL queries it makes to its database, i.e. misinterpreting user-input as SQL code rather than a string. Attackers can then insert malicious SQL code, causing the database to execute unintended commands.

It typically happens when queries are built by concatenating strings instead of using parameterised statements or are simply not sanitised (by removing special characters in user-input).

Types

General

• Stacked Queries SQL Injection

In-band SQL Injection

• Union query-based SQL Injection
• Error-based SQL Injection

Blind SQL Injection

• Boolean-based SQL Injection
• Time-based SQL Injection

Out-of-band SQL Injection

Mitigation

• Input sanitation: filtering user data to avoid SQL injections, e.g. remove or escape special characters ', ", or --.
• Input validation: ensure that input fits some expected pattern, e.g. ending in @<something>.com when expecting e-mail.
• Parameterised queries: these contain placeholders for input data in the application code instead of directly passing input into SQL queries.
• Manage user privileges: restrict privileges to users to those strictly necessary.
• Web application firewall: detect and reject HTTP requests with malicious content, .e.g any request containing the MySQL INFORMATION_SCHEMA.