SQL Injection Attacks and Defense - 2009

26 Chapter 1 • What Is SQL Injection?
Frequently Asked Questions
Q: What is SQL injection?
A: SQL injection is an attack technique used to exploit code by altering back-end SQL
statements through manipulating input.
Q: Are all databases vulnerable to SQL injection?
A: To varying degrees, most databases are vulnerable.
Q: What is the impact of an SQL injection vulnerability?
A: This depends on many variables; however, potentially an attacker can manipulate data
in the database, extract much more data than the application should allow, and possibly
execute operating system commands on the database server.
Q: Is SQL injection a new vulnerability?
A: No. SQL injection has probably existed since SQL databases were first connected to
Web applications. However, it was brought to the attention of the public on Christmas
Day 1998.
Q: Can I really be prosecuted for inserting a quote character (‘) into a Web site?
A: Yes, unless you have a legitimate reason for doing so (e.g., if your name has a single-quote
mark in it, such as O’Neil).
Q: How can code be executed because someone prepends his input with a quote character?
A: SQL databases interpret the quote character as the boundary between code and data.
It assumes that anything following a quote is code that it needs to run and anything
encapsulated by a quote is data.
Q: Can Web sites be immune to SQL injection if they do not allow the quote character to
be entered?
A: No. There are a myriad of ways to encode the quote character so that it is accepted as
input, and some SQL injection vulnerabilities can be exploited without using it at all.
Also, the quote character is not the only character that can be used to exploit SQL
injection vulnerabilities; a number of characters are available to an attacker, such as
the double pipe (||) and double quote (“), among others.