SQL Injection Attacks and Defense - 2009

418 Chapter 10 • References
SELECT username, password FROM tblUsers UNION SELECT username, password FROM
tblAdmins
UNION SELECT will automatically compare the values returned by each SELECT
statement and return only distinct values. To permit duplicates and prevent the database
from comparing the returned data, use UNION ALL SELECT:
SELECT username, password FROM tblUsers UNION ALL SELECT username, password
FROM tblAdmins
INSERT Statement
As you have probably guessed already, you use the INSERT statement to insert data into
a table. You can structure the INSERT statement in two different ways to achieve the same
goal. The following INSERT statement will insert the values 5, john, smith, and 0 into the
tblUsers table:
INSERT INTO tblUsers VALUES (5,'john','smith',0)
In this example, the data to be inserted into the table is arranged in the correct order to
correspond with each column in the table. The most significant problem with this approach
is that if the table structure is changed (e.g., columns are added or deleted) data could be
written to the wrong column. To avoid potentially harmful mistakes the INSERT statement
can accept a comma-separated list of target columns following the table name:
INSERT INTO tblUsers(id, username, password, priv) VALUES (5, 'john','smith',0)
In this example, each target column is listed to ensure that the supplied data is inserted
in the correct column. If the table structure changes, the INSERT statement will still target
the correct columns.
UPDATE Statement
You use the UPDATE statement to modify existing data within a database table. The following
UPDATE statement will change the priv column value to 0 for all records that have the
username value of sarah:
UPDATE tblUsers SET priv=0 WHERE username = 'sarah'
It is important to note that all UPDATE statements should include a WHERE clause
to indicate which rows should be updated. If you omit the WHERE clause, all rows are affected.
DELETE Statement
You use the DELETE statement to delete rows from a table. The following DELETE
statement will delete all rows from tblUsers that have a username value of admin:
DELETE FROM tblUsers WHERE username = 'admin'