Objective-C : SQL injection

SQL injection is possible. This can be exploited to bypass the authentication mechanism, access all database entries, or execute malicious code with application rights.

Client side code injection attacks take the first place in the “OWASP Top 10 2017” web application vulnerabilities ranking and the seventh place in the “OWASP Mobile Top 10 2014”. ranking. The level of potential damage from such an attack depends on the user input validation performance and file protection mechanisms.

SQL Injection occurs when a database query is based on data from an untrusted source (e.g., user input). In the absence of proper validation an attacker can modify the query to execute malicious SQL query.

The most common variants of SQL injection:

• Direct addition of malicious code into a string variable, based on which the SQL query is generated.
• Premature termination of the correct SQL command via the “– ” sequence of characters (interpreted as the beginning of a comment). The contents of the string after this sequence will be ignored during the execution of SQL command.
• Addition of the “;” character (interpreted as the end of the command), and other malicious commands (request splitting) to the input string variable.
• Password guessing via the sequential execution of SQL queries.