SQL Injection Homework Help, Assignment Help, Online Tutor, Tutoring

Submit Assignment

* *

Payment Online Assignment Help

Asp dot net Project Homework

Homework Help

sfsf

SQL Injection

Most databases are set up in a way that makes breaking in relatively easy. But securing the database has become simpler. A few straightforward steps can vastly improve security, usually by locking out all users except applications and DBAs.

But even that restriction doesn't completely protect your data. One of the primary security breaches organizations experience today takes place via applications that connect to databases. Applications don't use native database security. Instead, they access the database as a "super user" and, therefore, could represent a risk to data security. One of the most common examples of exploiting this risk is known as SQL injection.

SQL injection isn't a direct attack on the database. Instead, it takes advantage of the way many Web applications that access databases are developed. SQL Injection attempts to modify the parameters passed to a Web application via a Web form to change the resulting SQL statements that are passed to the database and compromise its security. If successful, an attacker can hijack the database server and be granted the same permissions to add, drop, and change users that the application has. From that point, the database is fully exposed.

Unfortunately, the practice of SQL injection is easy to learn. Fortunately, with a little forethought, you can prevent it. The simplest way to find out if you're vulnerable to an SQL-injection attack is to enter a single quote into each field on each form in your applications and verify the results. Some applications will return a message claiming a syntax error. Some applications will catch the error and not report anything. In both of these cases, your site has some protection from SQL injection, but don't assume it's secure. You can only validate your level of protection by going to the application's source code. I'll explain what well-protected source code should contain later in this column.

A hacker will use SQL injection to modify a query in order to send (via the application) commands to the database that the developer never intended. Take the following example:

SELECT * FROM my_table

WHERE column_a =

'1' UNION select userid, password from

DBA_USERS WHERE 'a'='a'

Typing this command into a form at the right place in a vulnerable application will give the hacker access to user accounts and passwords. Even if the passwords are encrypted, obtaining a list of all users can severely compromise database security.

Applications can be the poison of databases given their "super-user" privileges, especially when the applications aren't created with as much concern for security as is typical for databases.