SQL INJECTION

SQL Injection

[Date of Submission]SQL Injection

Introduction

In a globalized world in which we live today, with technology becoming increasingly accessible and making information the most valuable currency in the economy, mobility and flexibility of access systems have become indispensable factor in developing computer applications, which until sometimes back were mainly run locally on desktops. Today, these applications are being gradually migrated to web. It is now common to see small companies having customers in several geographic regions, with sales throughout the country, using systems that can both run on desktops as well as on handheld devices like Smartphones, with the availability same features by only changing the user interface in accordance with the target device. The Internet, in fact, brought many positives and new concerns to developers. With the emergence of web applications, which start working on servers outside the physical domains of companies, sensitive information traveling over a network has also brought about concerns about the safety of data being transmitted over the Internet (Nystrom, 2007).

Applications are now being accessed remotely on servers that have become targets of attackers, also called computer hackers, seeking sensitive information for personal gain. Currently the majority of the sites are dynamic and there is constant exchange information to the database, and communications between the web applications and the backend database systems is made possible through SQL - Structured Query Language, used by 90% of applications (Clarke, 2009). The exchange of information between the application and the database, whether it is local or remote, if it has flaws, can be exploited by malicious software, inserting codes, allowing access to information by unauthorized persons, which is technically known as SQL Injection.

According to computer scientists, SQL Injection has become perhaps the most widely used method to compromise web applications, thanks to its relative simplicity and high success rate. In the “Information Age”, in which the most valuable asset is intangible, the question is how developers are dealing with this huge responsibility? The challenge is to develop increasingly innovative sites, coupled with mechanisms that will provide security to users. The purpose of this paper is to present what is SQL Injection, while exploring different techniques to prevent and enable the developer to build more robust systems (Oppliger, 2000).

Databases

The Database is at the heart of today's dynamic web sites, so they are the most important and most endangered components of web projects. Hackers, are increasingly attracted by the information (often confidential) that is contain within the database, they love to test to discover bugs or damage them and steal the contents (Bri, et al., 2005). There are different types of databases, which have developed their own specific syntax: the most popular databases are: Access, MySql, SqlServer, Oracle, Interbase, Postgres.

Queries

Queries are those instructions that a developer uses to read, write, or delete data in a table in a database and often pass for display the result of these operations performed on a database.

A standard query looks like this:

SELECT * FROM TABLE

The above mentioned query means “select all ...