Tag Info

Hot answers tagged

706

The way I demonstrate it to complete non-techies is with a simple analogy. Imagine you're a robot in a warehouse full of boxes. Your job is to fetch a box from somewhere in the warehouse, and put it on the conveyor belt. Robots need to be told what to do, so your programmer has given you a set of instructions on a paper form, which people can fill out and ...


54

Here's a real-world non-technical analogy. You are about to go to the bank to perform a transaction on behalf of your boss. Your boss gave you an envelope with instructions for the cashier. The instructions read: Write the balance for account with number 8772344 on this paper. Signed, Boss You leave the envelope out of your sight for a few minutes ...


52

One of the easiest ways to illustrate the problem behind SQL-injection is to use an image like this. The problem is the receiving ends ability to seperate data from command.


44

Think about it this way On one hand, there's nothing wrong with it. If your application is secure enough against SQL Injection, then an attacker won't be able to do much with that information. Unless you're naming your tables table_2231 and your columns column_4231 (in which case I hate you), it's not gonna be difficult to guess your tables names anyway. ...


39

Why can't we escape all user input using "magic"? At the time the magic is applied, it is unknown where the data will end up. So magic quotes are destroying data that, unless it is written unescaped to a database. It may just be used in the HTML response sent back to the client. Think of a form that has not beem filled in completely and is therefore ...


37

If you're really explaining to your grandmother, use writing a paper check as an example. (In the USA) back in the day, you'd write the dollar amount numerically in one field, then you'd write the same thing in words. For example in one field, you'd write "100.00" and in the second, longer field, you'd write "One hundred dollars and zero cents". If you ...


28

SQL injection most commonly happens when a programmer builds an SQL command by appending together (or interpolating) strings, using user-supplied input. e.g. Imagine this extract from a vulnerable piece of user authentication (login) pseudocode from a fictional web application. username = getPostData( "username" ); password = getPostData( "password" ); ...


27

The character ' is used because this is the character limiter in SQL. With ' you delimit strings and therefore you can test whether the strings are properly escaped in the targeted application or not. If they are not escaped directly you can end any string supplied to the application and add other SQL code after that. The character ; is used to terminate ...


26

The specific question is SQL injection with AND 1=1 and not OR 1=1. There is a big difference here in what the OP is asking about. If I were your teacher and you provided me with JonathanMueller's answer you would get a lousy grade as you dont understand the question. AND 1=1 is usally used in blind SQL injections. This is when you have to determine ...


26

When this string is decoded from its url-encoded form it becomes the following: 25' having 1=1-- This string, when placed as is into, for example, the following (PHP) database query function: mysql_query("SELECT * FROM users WHERE username = '$username'"); Becomes this: mysql_query("SELECT * FROM users WHERE username = '25' having 1=1--'"); Note ...


23

First of all "UTF-16 ASCII encoding" is a contradiction, since UTF-16 and ASCII are mutually-exclusive encoding schemes. But presumably he's just referring to using Unicode to bypass filtering mechanisms. The general principle is this: we often think of characters encoded in ASCII -- "A" is the number 65, "z" is the number 122. But that's not the only ...


22

There are a number of ways of testing an application for vulnerabilities such as SQL Injection. The tests break down into three different methodologies: Blind Injection: MySQL example: http://localhost/test.php?id=sleep(30) If this SQL statement is interpreted by the database then it will take 30 seconds for the page to load. Error Messages: ...


21

The idea that first came to mind was to explain it in terms of a Mad Lib. The stories where words are left out, and to fill in the blanks you ask the group for words of the types indicated and write them in, then read the resulting story. That's the normal way to fill out a Mad Lib. But what if someone else knew the story and what blanks you were filling in ...


20

One explanation I haven't seen here is that many financial institutions are tightly integrated with older systems and are bound to the limitations of those systems. The irony of this is that I have seen systems that were built to be compatible to older systems but now the older systems are gone and the policy still must exist for compatibility with the ...


20

Guarantee of 100% safe from SQL injection? Not going to get it (from me). In principle, your database (or library in your language that is interacting with the db) could implement prepared statements with bound parameters in an unsafe way susceptible to some sort of advanced attack, say exploiting buffer overflows or having null-terminating characters in ...


20

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is SELECT * FROM users WHERE username = '<placeholder>' then I can turn this query to SELECT * FROM users WHERE username = 'admin' AND 1=0 --' when using admin' AND 1=0 -- as value for the placeholder. ...


19

It doesn't matter if its $_GET, $_POST, $_REQUEST, $_FILE or even $_SERVER. Its all user input and a there for a potential source of an attack. What matters is how the user input is being used. In the case of SQL Injection, casting it to an int, such as intval() works well. However, you should be using parameterized queries with a library like ...


18

Already very good answers on this question, however I would like to mention some more: Secure coding (which is already been mentioned by many already) Escaping user input Parameterized queries (prepared statements, predefined queries where you only bind variables) Code defensively Monitoring for attacks Network Intrusion Detection System (NIDS) Host ...


18

You've come to the right place. Welcome to IT security! is there any sql injection for this code? Yes if there is what is that Entry? username: [any username from your website]" /* password: sux0r")*/ OR ("1"="1 It will run this query: SELECT * FROM `config` WHERE `config_admin_username`="[any username from your website]" /* AND ...


17

In PHP you cannot stack querys with a semicolon. However you can nest a query into another with parentheses (commonly called subqueries), e.g.: SELECT * FROM vulnerable_table WHERE id = (SELECT number from other_table) Using this technique (disregarding whether you output your SQL result or not) a keen attacker may extract all data from your database. ...


17

I'm assuming your using standard PHP mysql_query function in which case something like this would be effective in your example. SELECT price FROM products WHERE 1=1 AND id= 999999999999999999999999 UNION ALL (SELECT CONCAT(username, ' ', password) FROM user) limit 0, 1; Explanation Use an ID of a product that is not going to exist. UNION with ...


17

Many common SQL servers support functions such as xp_cmdshell that allow the execution of arbitrary commands. They are not in the SQL standard so every database software has different names for it. Furthermore there is SELECT ... INTO OUTFILE, that can be used to write arbitrary files with the permissions of the database user. It may be possible to ...


15

I would explain it as being like telling a cashier that the customer is always right and they should do whatever they can to meet the customer's need. Then since there are no checks about the reasonableness of the request, when a customer comes in and says they want the entire store for free, the cashier loads all the inventory in to their truck for them. ...


15

Prepared statements, parameterized queries, escaping all user input, for a good starter see http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet.


15

Summary. Yes, the issue is that, in some character encodings (like UTF-8), a single character is represented as multiple bytes. One way that some programmers try prevent SQL injection is to escape all single quotes in untrusted input, before inserting it into their SQL query. However, many standard quote-escaping functions are ignorant of the character ...


15

Is the above code vulnerable to any kinds (error,blind,union based) of SQL injection? No, but only because sha1() happens by luck to produce output that never contains any SQL metacharacters. Your query-creating code should not need to know about that implementation detail. It should be escaping the $password_hash as well, so that the line of code ...


14

Normally, you would see the phrase being "OR 1=1'". The reason is, if the programmer doesn't properly handle parameters (like user id), then an attacker could use an OR 1=1 to return all data in the table. For example, say we want to get details about a user named smith. The query could be select * from user where id = '?', where the question mark gets ...


14

Exposing table names might have broader consequences than you expect. For instance you could be putting your company at legal disadvantage by disclosing a table names like "deleted_messages", "profile_views", "single_female_users" etc. Retention of that data and user privacy suddenly becomes a topic of discussion and can cost much. You cannot always control ...


14

SSL Connection to the server so no one can sniff passphrases or data over the network. Don't forget your backup: it should be encrypted too. The key should be stored independently so if someone gains access to the backup he cannot use the data. Depending on your country of residence there can be legal requirements for health data protection. Manage access ...


14

No. SQL Injection should be prevented by parameterizing your queries. OWASP has some great resources to help you with this. Here is one such sheet to show this in several languages. The PHP cheat sheet also has some more information regarding sql injection. To directly address your hard coded filter function check out this source demonstrating the ...



Only top voted, non community-wiki answers of a minimum length are eligible