What is SQL Injection: Critical Web Vulnerability

---

Web applications and databases are critical components of most businesses. They handle vast amounts of data, including sensitive information such as usernames, passwords, personal details, and financial records. As the importance of databases grows, so do the risks associated with their security. One of the most dangerous and common web vulnerabilities is SQL Injection (SQLi). This attack can lead to devastating consequences for organisations, including data theft, financial loss, and reputational damage. In this content, we’ll explore what SQL injection is, how it works, the risks it poses, and how to prevent it.

If you are not familiar with SQL programming, you can explore our SQL series of tutorials.

What is SQL Injection?

SQL injection is a technique used by attackers to manipulate the queries that an application makes to its database. By injecting malicious SQL code into an application’s input fields (such as login forms, search bars, or URL parameters), an attacker can alter the query’s logic. This allows them to access, modify, or delete sensitive data, bypass authentication, or, in severe cases, execute commands on the database server.

SQLi occurs when an application fails to properly validate or sanitise user input. When an application inserts untrusted data directly into a SQL query without proper precautions, the database interprets that input as part of the query itself, executing it as SQL code.

How Does SQL Injection Work?

To understand how SQL injection works, let’s look at a simple example involving a login form. Consider the following SQL query, which checks if a username and password match a record in the database.

Please be aware the following examples are only for this tutorial’s illustration purposes.

SELECT * FROM users WHERE username = 'admin' AND password = 'password123';

In a legitimate scenario, this query would run when a user enters “admin” as the username and “password123” as the password. If a matching record is found, the user is authenticated.

However, if an attacker enters the following into the username field:

• Username: admin'--
• Password: anything

The resulting query becomes:

SELECT * FROM users WHERE username = 'admin'--' AND password = 'anything';

The -- is a SQL comment indicator, which causes the rest of the query to be ignored. This means that the database only checks if the username is admin and disregards the password entirely. As a result, the attacker is able to log in as the user “admin” without needing the correct password.

Types of SQL Injection

There are several types of SQL injection attacks, each exploiting the vulnerability in different ways.

1. In-Band SQL Injection (Classic SQLi)

This is the most common type of SQL injection, where the attacker uses the same communication channel to both inject the malicious code and retrieve data. The query is modified to directly expose data, as in the login example above. This attack can return sensitive information like user credentials or private data from the database.

2. Error-Based SQL Injection

In this type of attack, the attacker intentionally causes the database to throw an error, which often reveals valuable information about the database structure, such as table names, column types, or versions. For instance, an attacker might inject a query like this (see below).

SELECT * FROM users WHERE username = 'admin' AND extractvalue(1,concat(0x3a,(select @@version))) --';

This can cause the database to return an error message revealing sensitive information that aids further exploitation.

3. Union-Based SQL Injection

The attacker uses the UNION SQL operator to combine the results of the original query with another query. This allows the attacker to retrieve additional data from other tables within the database. For example, the following query injects a UNION to pull credit card information.

SELECT username, password FROM users WHERE id = 1 UNION SELECT credit_card_number, security_code FROM credit_cards;

4. Blind SQL Injection

In blind SQL injection, the attacker doesn’t directly see the result of the query but can infer information based on the application’s behavior. For instance, an attacker might inject conditions that return a true or false value, causing different responses or delays. There are two types of blind SQLi.

• Boolean-Based Blind SQL Injection: The attacker changes the query to produce different responses based on whether the condition is true or false.
• Time-Based Blind SQL Injection: The attacker injects SQL code that causes the database to delay its response, inferring the result based on the time it takes to receive a response.

Risks of SQL Injection

The consequences of a successful SQL injection attack can be catastrophic for organisations. Some of the major risks include (see list below).

1. Data Theft: Attackers can gain unauthorised access to sensitive information, such as user credentials, personal details, and financial data. This can lead to identity theft, financial fraud, and data leaks.
2. Authentication Bypass: SQL injection can allow attackers to bypass authentication mechanisms and gain unauthorised access to systems. For example, attackers can log in as administrators or other privileged users without knowing their actual passwords.
3. Data Tampering: Attackers can insert, update, or delete data in the database. This can lead to incorrect data being stored, data loss, or even complete deletion of database tables.
4. Database Corruption: Attackers can destroy or corrupt entire databases, resulting in service disruptions, downtime, and loss of critical business information.
5. System Compromise: In some cases, SQLi can give attackers control over the underlying server or operating system, allowing them to execute commands and take full control of the system.

How to Prevent SQL Injection

Preventing SQL injection attacks requires a multi-layered approach, focusing on secure coding practices, proper validation, and limiting the impact of potential vulnerabilities.

1. Use Parameterised Queries (Prepared Statements)

Parameterised queries, also known as prepared statements, separate SQL code from user input. This ensures that input is treated as data and not executable SQL. Th following is an example of a prepared statement in PHP.

$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);

For more on PHP and SQLi, refer here.

2. Stored Procedures

Stored procedures are pre-defined SQL queries that reside in the database and execute predefined logic. They can limit SQL injection risks by controlling how user input is handled.

3. Input Validation and Sanitisation

Validate and sanitise user input to ensure it conforms to the expected format and contains only valid characters. Reject any input that does not meet these criteria.

4. Use of Web Application Firewalls (WAF)

Web Application Firewalls can detect and block SQLi attempts in real-time by inspecting incoming requests and filtering out malicious traffic.

5. Principle of Least Privilege

Limit the permissions of database accounts used by the application. Ensure that these accounts only have the necessary permissions to perform specific tasks, minimising potential damage.

The Bottom Line

SQL injection remains one of the most dangerous vulnerabilities affecting web applications today. It allows attackers to access, manipulate, or destroy sensitive data, bypass authentication mechanisms, and compromise entire systems. Organisations can protect their databases from SQLi by following secure coding practices, validating user input, and using technologies like parameterised queries and firewalls. As database security continues to be a critical concern, businesses must remain vigilant and proactive in mitigating SQL injection risks.

---