SQL Injection Attacks and Defense - 2009

62 Chapter 2 • Testing for SQL Injection
Inline SQL Injection
In this section, I will show you some examples of inline SQL injection. Inline injection
happens when you inject some SQL code in such a way that all parts of the original query
are executed.
Figure 2.10 shows a representation of an inline SQL injection.
Figure 2.10 Injecting SQL Code Inline
Injecting Strings Inline
Let’s see an example that illustrates this kind of attack so that you can fully understand how
it works.
Victim Inc. has an authentication form for accessing the administration part of its Web
site. The authentication requires the user to enter a valid username and password. After sending
a username and password, the application sends a query to the database to validate the
user. The query has the following format:
SELECT *
FROM administrators
WHERE username = '[USER ENTRY]' AND password = '[USER ENTRY]'
The application doesn’t perform any sanitization of the received data, and therefore we
have full control over what we send to the server.
Be aware that the data entry for both the username and the password is enclosed in two
single quotes which you cannot control. You will have to keep that in mind when crafting a
valid SQL statement. Figure 2.11 shows the creation of the SQL statement from the user entry.