What is a SQL Injection Attack

Question

Hi friends, Ques : I want to know that what is a SQL Injection Attack. Please explain in brief?

Jignesh Trivedi · Answer

hi, SQL injection is an attack in which wicked code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically correct queries that it receives. For example String orderNumer = Request.QueryString["MyTest"] I will pass Query String "MyTest" to "AA001" Then Query: String sql = "Select * from Orders where number ='"+ orderNumer + "' // Actual Query : Select * from Orders where number = 'AA001' Now some user pass data in "MyTest" Query String "AA001' ;Delete From Order - -" Actual Query: Select * from Orders where number = 'AA001'; Delete From Order - -' hope this help.

Senthilkumar · Answer

The sql injection is passing some destructive commands to the sql server while passing the query process statements. For example when you try to do DML statements from the front end (search the text), web site hackers used to pass the DROP, TRUNCATE, DELETE. For example, when you try to search some thing in the text box string strquery = "SELECT * FROM Employees WHERE employeeName LIKE '''+txtSearch.Text+"'"; here hackers used to pass some thing like jack;'DROP TABLE employees it will be two set of statement to execute. It will be done in the sql server. It can be overcommed using the stored procedure. I suggest you to go through the below urls: http://www.unixwiz.net/techtips/sql-injection.html http://msdn.microsoft.com/en-us/library/ms161953.aspx

Vulpes · Answer

Please check this link: http://en.wikipedia.org/wiki/SQL_injection