SQL Injection Attacks and Defense - 2009

416 Chapter 10 • References
Introduction
This chapter contains a number of topics that should be useful reference items for
understanding SQL injection. These range from a simple introduction to the basic
Structured Query Language (SQL) itself, to helping you understand how SQL works
under normal circumstances, therefore helping you to rewrite SQL statements in a way
that continues to be syntactically correct.
Additionally, the chapter provides a series of SQL injection cheat sheets for quickly
jumping to the material you’re interested in, perhaps just to remind you how SQL injection
works or what the syntax is. I have also provided a table of troubleshooting tips which will
assist you in overcoming the most commonly encountered problems when exploiting SQL
injection vulnerabilities. Finally, you’ll find some information about databases not discussed
in this book—we’ve used Microsoft SQL Server, Oracle, and MySQL in our examples so
far, largely due to their widespread adoption in the real world. Check out “SQL Injection
on Other Platforms” for information about exploiting SQL injection on platforms other
than those.
Structured Query
Language (SQL) Primer
SQL was originally developed at IBM in the early 1970s but was not officially formalized until
1986 by the American National Standards Institute (ANSI). SQL was initially designed as a
data query and manipulation language with limited functionality when compared to today’s
feature-rich SQL dialects. In this section, I’ll provide a brief overview of the common SQL
queries, operators, and features. If you are already familiar with SQL, you can skip this section.
Each major database vendor has extended the SQL standard to introduce features specific
to their own product. For our purposes, we will use the SQL standard defined by the
International Organization for Standardization (ISO) since this will be valid for most database
platforms. Where necessary I will highlight platform-specific variations to the standard.
SQL Queries
SQL queries are made up of one or more SQL statements that are effectively instructions
for the database server to carry out. The most common SQL statements you will encounter
when working with a database or performing SQL injection are SELECT, INSERT,
UPDATE, CREATE, UNION SELECT, and DELETE.
SQL queries that are designed to read, delete, or update table data will often include a
conditional clause to target specific rows in a table. A conditional clause begins with
WHERE followed by the condition. The OR and AND operators are used when multiple
conditions are to be evaluated.