DBMS Injection

Malicious user can simply make use of = and or operator 

Select * from User where
(Username = “” or 1=1) AND
(Password=”” or 1=1).

Impact of the SQL injection 

• Hacker can retrieve all users’ data present in the database like mobile number, credit card information which is highly confidential and can gain access to admin portals
• Almost all online shopping applications, definitely use backend database servers and if they are exploited through SQL injection entire server is compromised.

Preventing SQL injection

• Strong user authentication: User input should be validated by predefining length and type of the input and then authenticating the user
• Restricting access privileges: Limiting the amount of information a user can view and restricting the user not to be granted permission to access everything in the database
• Using views: By using views, Virtual Table is displayed to the users and becomes difficult to manipulate the original database table and by making most of the views as read-only
• Secure Coding: Secure coding is applied so that a strong level of authentication is done each time the code has been updated.

Simple implementation example 

• The login page is bypassed whereas injection can provide an attacker with unauthorized access to sensitive data like customer data trade secrets and intellectual property
• There is also an SQL Injection Automation tool sqlmap which is used to perform all type of SQL injection.

$stmt = $dbConnection->prepare('SELECT count(*) FROM users WHERE username = ? AND password = ?');
$stmt->bind_param('ss', $username,$password);
$stmt->execute();
$result = $stmt->get_result();
echo $result;
?>