Concept - SQL Injection

SQLi: one of the most prevalent and dangerous network-based security threats; it sends malicious SQL commands to the database server; can modify or delete data, execute arbitrary OS commands, launch DoS attacks (s.11).

Tautology example (s.13-14): code SELECT * FROM items WHERE ID = ' + username + ' AND password = ' + password + '. Attacker wiley types the password name' OR 'a'='a:

SELECT * FROM items
WHERE ID = 'wiley' AND password = 'name' OR 'a'='a';

OR 'a'='a' is always true, so the query equals SELECT * FROM items; and returns all rows regardless of the password.

Piggyback + comment (s.15): input John'; DROP table Course;-- terminates the string, appends a new command, and -- comments out the rest (removing the leftover quote).

Typical path (s.12): hacker $\to$ Internet $\to$ router/firewall $\to$ web servers $\to$ web application server $\to$ database servers (credit card data retrieved).

Related: Concept - SQLi Categories, Concept - SQLi Countermeasures, Concept - SQL. Appears in 05 Database Security - Chunk 01 (s.1-38).