SQL Injection Attacks and Defense - 2009

References • Chapter 10 417
For the purposes of this tutorial, each example query is aimed at the tblUsers table unless
otherwise specified. Table 10.1 outlines the structure of the tblUsers table.
Table 10.1 Example SQL Table, tblUsers
ID Username Password Privilege
1 gary leedsutd1992 0
2 sarah Jasper 1
3 michael w00dhead111 1
4 admin letmein 0
SELECT Statement
The primary role of the SELECT statement is to retrieve data from a database and return
it to the application or user. As a basic example, the following SQL statement will return
data from every row and column within the tblUsers table:
SELECT * FROM tblUsers
The asterisk (*) character is a wildcard that instructs the database server to return
all data. If only specific columns are required, the name of each column is listed in place
of the wildcard. The following example will return the username column for all rows
within tblUsers:
SELECT username FROM tblUsers
To return specific rows from a table based on conditional criteria, you can add the
WHERE clause followed by the desired condition. For example, the following SQL query
will return all rows that have a username value of admin and a password value of letmein:
SELECT * FROM tblUsers WHERE username ='admin' AND password = 'letmein'
Microsoft SQL server also allows you to use SELECT statements to read table data
from one table and insert it into another. In the following example, all data from the tblUsers
table is copied into the hackerTable table:
SELECT * INTO hackerTable FROM tblusers
UNION Operator
You use the UNION operator to combine the result sets of two or more SELECT statements.
All SELECT statements within the union must return the same number of columns and
their data type must be compatible. In the following example, the SQL query will combine
the username and password columns from the tblUsers and tblAdmins tables: