Hosting generously provided by
|
|
What is SQL Injection?
|
"An attack technique used to exploit web sites by altering backend SQL statements through manipulating application input."
SQL Injection happens when a developer accepts user input that is directly placed into a SQL Statement
and doesn't properly filter out dangerous characters. This can allow an attacker to not only steal
data from your database, but also modify and delete it. Certain SQL Servers such as Microsoft SQL Server
contain Stored and Extended Procedures (database server functions). If an attacker can obtain access
to these Procedures it may be possible to compromise the entire machine. Attackers commonly insert
single qoutes into a URL's query string, or into a forms input field to test for SQL Injection.
If an attacker receives an error message like the one below there is a good chance that the application
is vulnerable to SQL Injection.
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the
keyword 'or'.
/wasc.asp, line 69
Additional information on SQL injection including useful articles and links can be found at our SQL Injection page below
Also See 'Blind SQL Injection'
|
|
|
Information contained on this website may not be copied without explicit permission.
Best Viewed with Netscape.
|
|
|
Subscribe to CGISecurity.com
|
|
|
|
|
|
The Web Security Mailing List
|
|
|
|
|
Contact us
|
Post News, get linkage!
|
|
|
|
