SQL Injection
OWASP Top 10 2025 Mapping
- **A03:2025 - Injection** (SQL Injection)
---
Definition
**SQL Injection** is a code injection vulnerability where an attacker inserts malicious SQL statements into an
entry field, allowing them to manipulate database queries. When user input is directly concatenated into SQL
queries without proper sanitization, attackers can access, modify, or delete data.
SQL Injection occurs when:
- User input is directly concatenated into SQL queries
- Input is not properly validated or parameterized
- Dynamic SQL is constructed without prepared statements
- Error messages reveal database structure
---
How SQL Injection Works
Normal Query: SELECT * FROM users WHERE email='user@[Link]'
Injected Input: user@[Link]' OR '1'='1
Resulting Query: SELECT * FROM users WHERE email='user@[Link]' OR '1'='1'
Result: Returns all users (condition always true)
---
Types of SQL Injection
1. **Union-based SQLi**
Original: SELECT id, name FROM products WHERE id=1
Injected: SELECT id, name FROM products WHERE id=1 UNION SELECT 1,username FROM users--
Result: Returns product columns + usernames
2. **Boolean-based Blind SQLi**
Original: SELECT COUNT(*) FROM users WHERE email='test@[Link]'
Injected: test@[Link]' AND '1'='1
Injected: test@[Link]' AND '1'='2
Compares responses to determine true/false conditions
3. **Time-based Blind SQLi**
Injected: admin' AND SLEEP(5)--
If response takes 5+ seconds, condition is true
4. **Stacked Queries**
Injected: 1; DROP TABLE users;--
Executes multiple SQL statements
5. **Error-based SQLi**
Injected: 1' AND extractvalue(0,concat(0x7e,(SELECT version())))--
Reveals database information in error messages
---
Common SQLi Payloads
| Payload | Purpose |
|---|---|
| `' OR '1'='1` | Bypass authentication |
| `'; DROP TABLE users;--` | Delete tables |
| `1 UNION SELECT version(),user(),3--` | Enumerate database |
| `1 AND SLEEP(5)--` | Time-based detection |
| `1' OR 1=1--` | Return all records |
| `admin'--` | Comment out password check |
| `1' AND (SELECT COUNT(*) FROM users) > 0--` | Boolean-based enumeration |
---
Attack Scenarios
Scenario 1: Authentication Bypass
Username: admin'--
Password: anything
Resulting Query: SELECT * FROM users WHERE username='admin'--' AND password='...'
Result: Logs in as admin without password
Scenario 2: Data Exfiltration
URL: /[Link]?id=1 UNION SELECT username,password,3 FROM users--
Result: Displays usernames and passwords
Scenario 3: Database Enumeration
/[Link]?id=1 AND @@version='5.7.31'-- (checks MySQL version)
/[Link]?id=1 AND @@servername='SERVER1'-- (checks server name)
---
Impact of SQL Injection
- **Data Breach:** Access sensitive data (PII, credentials)
- **Data Manipulation:** Modify/delete database records
- **Authentication Bypass:** Login without credentials
- **Privilege Escalation:** Gain admin/root access
- **System Compromise:** Execute OS commands
- **Denial of Service:** Drop tables, corrupt database
- **Compliance Violation:** GDPR, HIPAA breaches
---
Mitigation Strategies
1. **Parameterized Queries (Prepared Statements)**
// VULNERABLE
const query = `SELECT * FROM users WHERE email='${userEmail}'`;
[Link](query);
// SECURE
const query = 'SELECT * FROM users WHERE email=?';
[Link](query, [userEmail]);
2. **Object-Relational Mapping (ORM)**
// Using Sequelize
[Link]({ where: { email: userEmail } });
// Using TypeORM
await [Link]({ where: { email: userEmail } });
3. **Input Validation**
// Whitelist allowed characters
const sanitized = [Link](/[^a-zA-Z0-9_-]/g, '');
// Check data type
if (typeof id !== 'number') throw new Error('Invalid ID');
// Length restrictions
if ([Link] > 255) throw new Error('Email too long');
4. **Least Privilege Database Access**
-- Create limited user
CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE ON database.* TO 'app_user'@'localhost';
-- Restrict DROP, CREATE, ALTER
-- Never grant FILE, SUPER privileges
5. **Error Handling**
try:
[Link](query, params)
except Exception as e:
# Log error internally
[Link](f"Database error: {str(e)}")
# Return generic message to user
return "Database error occurred"
6. **Web Application Firewall (WAF)**
- Detect SQL keywords (DROP, UNION, EXEC, etc.)
- Block suspicious patterns
- Rate limiting on failed queries
---
PortSwigger Lab References
| Lab | Key Concept |
|---|---|
| SQL injection vulnerability in WHERE clause | Basic SQLi |
| SQL injection allowing login bypass | Authentication bypass |
| SQL injection UNION attack | Union-based enumeration |
| SQL injection UNION attack determining columns | Column discovery |
| Blind SQL injection | Boolean/Time-based exploitation |
---
Detection & Testing
**Manual Testing:**
1. Test with special characters: ' " ; -- /* */
2. Check for error messages revealing database type
3. Try UNION SELECT payloads
4. Test Boolean conditions: AND 1=1 vs AND 1=2
5. Measure response time (time-based detection)
**Tools:**
- SQLmap: Automated SQLi detection
- Burp Suite: Manual SQLi testing
- OWASP ZAP: SQLi scanning
- Sqlninja: SQLi exploitation
---
Secure Code Examples
[Link]/Express with MySQL
const mysql = require('mysql2/promise');
[Link]('/user/:id', async (req, res) => {
const connection = await [Link](config);
// Parameterized query
const [rows] = await [Link](
'SELECT * FROM users WHERE id = ?',
[[Link]]
);
[Link](rows);
});
Python/Flask with SQLAlchemy
from sqlalchemy import text
@[Link]('/user/<int:user_id>')
def get_user(user_id):
user = [Link](
text('SELECT * FROM users WHERE id = :id'),
{'id': user_id}
).first()
return jsonify(user)
PHP with PDO
$pdo = new PDO('mysql:host=localhost;dbname=db', 'user', 'pass');
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$_GET['email']]);
$user = $stmt->fetch();
Java with JDBC
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement pstmt = [Link](query);
[Link](1, userId);
ResultSet rs = [Link]();
---
Prevention Checklist
- Always use parameterized queries/prepared statements
- Never concatenate user input into SQL queries
- Validate and sanitize all inputs
- Use ORM frameworks
- Apply least privilege database permissions
- Hide database error messages from users
- Implement input length restrictions
- Use Web Application Firewall (WAF)
- Regular code review and security testing
- Keep database software updated
- Monitor for unusual database activity
---
SQL Injection Detection Query
-- Check for suspicious input patterns
SELECT * FROM access_logs
WHERE query LIKE '%UNION%'
OR query LIKE '%DROP%'
OR query LIKE '%INSERT%'
OR query LIKE '%DELETE%'
OR query LIKE '%UPDATE%'
OR query LIKE '%EXEC%'
OR query LIKE '%SELECT%FROM%FROM%';