SQL Injection Last Few Lectures XSS - Cross-site scripting - - PowerPoint PPT Presentation

SQL Injection

Last Few Lectures

• XSS - Cross-site scripting
• XSRF/CSRF - Cross-site request forgery

Code Injection Attacks

• Attacker executes arbitrary code on server
• “Programming the program”
• Not sanitizing user inputs/outputs

SQL Injection

• Attacker enters bad information which is sent to the

server

• Server executes a SQL query with unintended
• utcomes.

Sample SQL query

• dogs(name, breed, owner name)
• Danger, lab, Fred
• Tinkerbell, poodle, Teri
• select * from dogs where owner=‘$name’;
• select name from dogs where breed=‘$btype’;

Problem?

• $name and $btype are directly passed to the

function

• select * from dogs where owner=‘$name’;
• select name from dogs where breed=‘$btype';

SQL Injection

• 1. Post malicious input to form
• 2. Requests unintended

SQL query

• 3. Returns unintended

data to attacker

Malicious Input

https://xkcd.com/327/

Malicious Input

• select * from dogs where owner=‘$name’;
• suppose $name was ‘or 1=1- -
• or even ′ ; drop table dogs --

How to Thwart

• Don’t build SQL commands yourself.
• Use parameterized functions where you specify

what input you expect.

Demo

• hackthissite.org