In the 1990s when the internet was new to humanity, constructing a website did not require complex languages such as the CSS and JavaScript. However, as the technology advanced, the website grew leading to the discovery of server-side languages such as PHP and ASP, as well as CGI. Consequently, the website started recording input and site data in databases. It, therefore, means every server-side language supports the SQL databases. Attackers used this knowledge to develop an attack vector known as SQL injection.
Therefore, SQL injection is an attack vector where the hacker feeds malicious SQL script through web input page, thus accessing and manipulating an unauthorized data. This attack is one of the oldest, common and the most severe web attack. A successful hacker gains access to the company data allowing him to edit, delete or even perform the administration operations such as shutting the DBMS. The attack leads to questions of data confidentiality and integrity in the web application.
How does SQL Injection attack take place?
SQL is a standard programming language for accessing and manipulating relational database; it’s a way to communicate with the database. On the user interface, what appears is two empty entry boxes, where the user is supposed to enter their username and password. When the user enters the username and the password, the information is registered as an SQL query to the database. If the entered data is in the database, the user accesses the database and if the information is not in the database access is denied.
Most web input forms have no ways to block other entry apart from wrong username and password. Therefore, attackers use this disadvantage to input their request to the database via this web input form. Once the query is accepted, the results are sent to the application for processing, and thus verification is bypassed. If the authentication is avoided, the application logs in the hacker with the administrative account on the database. Hence, the attacker can delete or edit any records stored in the database as well as perform other administrative functions.
Types of SQL Injections attacks
An attacker can use various methods to initiate an attack on the database. Some of the common ways include:
Error-based
This method is the most straightforward, and it runs on MS-SQL Server. Here the attacker asks the database a question, and it responds with an error message including the information requested.
Time-base
In this attack, there is no error response, and hence it’s the hardest. However, hackers still attack the database by initiating a time delay and thus getting the needed information.
Union-based
This attack is the most popular attack where the hacker uses the integration of two statements to obtain information from the database.
Prevention of SQL injection
In the past, you had to write your SQL injection statement manually, but nowadays, there is automated software to get the job done. It, therefore, means exploits of the database will still be recurrence if security measures are not put in place. For example, when building a web user input form, the developer should try to construct mechanisms for blocking other inputs apart from the username and the password.
