SQL Injection Attacks in Student
Management Systems
Date: February 2026
1
Introduction
❖Databases store critical organizational data
❖Web applications interact using SQL
❖ SQL is the standard language used to communicate with
relational databases such as MySQL.
❖Improper input handling leads to SQL Injection
❖SQLi enables unauthorized access and data compromise
2
Categories of Attacks
❖ Injection attacks: when untrusted user input is not
properly validated.
❖ Authentication attacks: : aim to gain unauthorized access
to systems.
❖ Web application attacks: exploit weaknesses in how web
applications process user input.
❖ Data exposure attacks: aim to leak, intercept, or
improperly access sensitive information
❖ DoS attacks: aim to disrupt the availability of systems
3
Injection Attacks
SQL Injection: occurs when an attacker inserts
malicious SQL code into input fields
Command Injection: occurs in applications that use
Lightweight Directory Access Protocol for
authentication or directory services.
LDAP Injection: occurs in applications that use
Lightweight Directory Access Protocol for
authentication or directory services.
XML Injection: occurs when user input is embedded
into XML documents without validation
4
Authentication & Authorization
Attacks
❖ aim to gain unauthorized access to systems. It includes;
• Brute-Force and Password Guessing Attacks
• Session Hijacking Using Stolen Session IDs
• Privilege Escalation Due to Weak Role Enforcement
5
Web Application Attacks
XSS: occurs when an attacker injects malicious
JavaScript code into web pages.
CSRF: an attack where an authenticated user is tricked
into performing unintended actions.
Broken access control: occurs when applications fail to
properly restrict what authenticated users are allowed
to do.
Directory traversal: allow attackers to access files and
directories
6
Data Exposure Attacks
❖ occur due to weak encryption and poor [Link]
includes;
• Unencrypted Data Transmission :When sensitive data
transmitted without encryption (HTTP instead of
HTTPS)
• Man-in-the-Middle Attacks: occur when an attacker
secretly intercepts communication between the user and
the server.
• Data Leakage from Misconfigured Databases
7
Denial of Service Attacks
Flooding Servers with Excessive Requests: attackers
send a massive number of requests to a web server
Exhausting Database or Server Resources:
8
What is SQL Injection?
SQL Injection is a critical web application security
vulnerability
occurs when attackers are able to insert malicious SQL code
into application
Attackers manipulate query logic
Caused by insecure coding practices
• . SQL Injection is especially dangerous in systems like Student
Management Systems.
9
SQL Injection Attack Techniques
Authentication bypass: injecting such input forces the
WHERE clause of the SQL query to always return true.
Error-based: Exploits detailed database error messages
Blind SQLi: Used when the application does not
display database errors or query results.
Time-based SQLi: Uses database delay functions such
as SLEEP() to extract data by measuring response
time.
10
Common SQLi Payloads
• ' OR '1'='1'--
• ' OR 1=1--
• ' OR username='admin'--
• ' OR'1'='1' OR '1'='1
• ' OREXISTS(SELECT 1FROMusers)--
11
Vulnerabilities Leading to SQL Injection
Attacks
Lack of input validation
Dynamic SQL query construction
Absence of prepared statements
Plaintext password storage
Verbose database error messages
Excessive database privileges
12
Defense and Mitigation Techniques
Prepared Statements (Parameterized Queries)
Input Validation and Sanitization
Password Hashing
Principle of Least Privilege
Disable Detailed Error Messages
Web Application Firewall
Regular Security Testing
13
SQLi Attack Impacts
Authentication bypass
Data theft
Privilege escalation
Data destruction
14
Demonstration Setup
DBMS: MySQL
Business Area: Student Management
System (SMS)– Login Module
This schema stores user credentials and
roles (student, instructor, registrar and
HOD.)
15
secure login
page:[Link]
[Link]
16
Why Vulnerable
❖ Unvalidated User Input:
$u =$_POST['username'];
$p =$_POST['password'];
• User input is accepted directly from the client
• No validation, filtering, or sanitization is applied
❖ Dynamic SQL Query Construction:
$sql = "SELECT * FROM users WHERE username='$u' OR
password='$p'";
• User input is directly concatenated into the SQL query
• This allows attackers to inject SQL syntax
• Example payload: ' OR '1'='1'--
17
Count…….
Incorrect Authentication Logic:
username='$u' OR password='$p'
• The OR condition means only one condition must be true
• Attackers can bypass authentication without knowing any password
Automatic Privilege Assignment:
$_SESSION['role'] = $row['role'];
The attacker is logged in as the first matched user
Often results in admin, instructor, or registrar access
Direct Query Execution Without Protection
18
Why This Code Is Secure
❖ Prepared Statement Prevents Injection:
$stmt = $conn->prepare("SELECT username, password, role FROM users
WHERE username = ?");
• SQL structure is fixed before user input is added
• Prevents attackers from modifying query logic
❖ Safe Parameter Binding:
$stmt->bind_param("s", $u);
• User input is treated strictly as data
• SQL Injection payloads are neutralized
19
Count…
❖Secure Password Verification
if (password_verify($p, $row['password']))
Ensures password correctness
Prevents login bypass attacks
❖ Strict Authentication Logic
Login succeeds only if username exists AND password
matches
❖ Controlled Role Assignment
Roles are granted only after successful authentication
20
Summary
SQL Injection is a major web threat
Caused by insecure coding
Prepared statements and validation are
essential
21
22