Scribd
Upload
11 views8 pages

SQL Injection Attacks and Prevention

The document discusses SQL queries for selecting student information and creating a Persons table with age restrictions. It highlights the risks of SQL injection attacks, which can lead to unauthorized data access and manipulation. Prevention methods include using parameterized statements, escaping inputs, and sanitizing inputs to enhance security against such attacks.

Uploaded by

Vadim Chepegin
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
11 views8 pages

SQL Injection Attacks and Prevention

The document discusses SQL queries for selecting student information and creating a Persons table with age restrictions. It highlights the risks of SQL injection attacks, which can lead to unauthorized data access and manipulation. Prevention methods include using parameterized statements, escaping inputs, and sanitizing inputs to enhance security against such attacks.

Uploaded by

Vadim Chepegin
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

SELECT studentID, FirstName, LastName, FirstName + ' ' + LastName AS FullName FROM student;

CREATE TABLE Persons (


ID int NOT NULL,
LastName varchar(255) NOT NULL,
FirstName varchar(255),
Age int,
CHECK (Age>=18)
);
SELECT studentID, FullName, exam_score
FROM student
WHERE (studentID BETWEEN 1 AND 5 OR studentID = 8)
AND
exam_score NOT IN (1000, 1400);
SQL INJECTION ATTACK
OWASP #1

Injection attacks occur when maliciously crafted


inputs are submitted by an attacker, causing an
application to perform an unintended action
SQL injection attacks target databases
SQL INJECTION ATTACK

Extract sensitive information

Enumerate login details of registered users on the website

Delete tables of data

Inject even more malicious code


PREVENTION

Parameterized statements (makes sure the inputs passed into

the statements are treated in a safe manner)

Escaping inputs

Sanitizing inputs (ability of the server to reject inputs that look

suspicious)

You might also like