An attack that exploits a web application building SQL statements by simply concatenating user input, using the input to change the meaning of the command and manipulate the database without authorization. Prepared statements with placeholders are the fundamental countermeasure.
Japanese name: SQLインジェクション
SQL injection appears in 3 practice questions across 1 topic, including Information Security Basics.
Field: Information Security Basics
If an application builds an SQL statement by concatenating strings such as "… WHERE name = '", the input value and "'", a quotation mark in the input closes the string, and whatever follows is interpreted as SQL commands. With the textbook input ' OR '1'='1, the always-true condition "or '1' equals '1'" is added, letting authentication be bypassed. It can also lead to data being read, altered or deleted.
The fundamental countermeasure is prepared statements with placeholders (parameterized queries). The structure of the SQL statement is fixed first and the input is attached afterward only as values, so whatever characters it contains, it never becomes part of a command. The database libraries and frameworks of many programming languages provide this feature. Removing special characters from input is prone to gaps, and input checks on the browser side can be bypassed by attackers, so neither is a countermeasure on its own.
On top of the fundamental countermeasure, further layers include giving the account the application uses to connect to the database only the minimum privileges needed (the principle of least privilege), not showing detailed error messages to users, and detecting typical attack strings with a WAF (web application firewall). A WAF is only an aid and is no substitute for fixing the application.
Answer: C. Because the structure of the SQL statement is fixed first and the input is passed afterward only as values, so whatever characters the input contains, it is never interpreted as part of the command
With a prepared statement, an SQL statement whose values are replaced by symbols (placeholders), such as "SELECT … WHERE id = ? AND password = ?", is first passed to the database to fix its structure, and the input is then attached only as values (binding). The input is treated as data from start to finish, so even if it contains quotation marks it never becomes part of a command, such as one that adds a condition. Removing or escaping dangerous characters requires handling every detailed rule for each database type and character encoding without omission, and a single gap lets the attack succeed. Checks of input in the browser can be bypassed if the attacker sends requests directly without going through a browser, so they serve convenience and are not a security measure. In addition, giving the account used to connect to the database the minimum privileges keeps damage small.
Escaping can prevent it in some cases, but every rule for each database type and character encoding must be handled without omission, and a single gap lets the attack succeed. Prepared statements with placeholders are therefore the basic countermeasure.
No. Even short strings can change the meaning of a command. Limits on length or kinds of characters are supplementary measures; the fundamental countermeasure is prepared statements.
Entering special strings into input fields is a technical attack such as SQL injection, and trying candidates one after another is a brute-force attack.
Which of the following is an example of social engineering?SQL injection exploits a web application that builds database commands (SQL statements) by simply concatenating user input as strings.
In a web application, entering a string such as ' OR '1'='1…As an Amazon Associate I earn from qualifying purchases.
SQL Social engineering Phishing Cross-site scripting (XSS) Digital signature Hash function Message authentication code Multi-factor authentication Principle of least privilege Public-key cryptography