PHP : SQL injection

An SQL injection is possible. This can be exploited to bypass the authentication mechanism, access all database records, execute malicious code with application privileges.

Client side code injection attacks take the first place in the OWASP Top 10 2017 web application vulnerabilities ranking and the seventh place in the OWASP Mobile Top 10 2014 ranking. The level of potential damage from such an attack depends on the user input validation performance and file protection mechanisms.

SQL injection occurs when the database query is generated based on data from an untrusted source (e.g., from user input). In the absence of proper validation an attacker can modify the query to execute malicious SQL query.

The most common types of SQL injection attacks:

• Direct addition of malicious code into a string variable, based on which the SQL query is generated.
• Premature termination of the correct SQL command via the “–” sequence of characters (interpreted as the beginning of a comment). The contents of the string after this sequence will be ignored during the execution of SQL command.
• Addition to the input string variable of the “;” character (interpreted as the end of the command), and other malicious commands (request splitting).
• Password guessing through the repeated execution of SQL queries.

It is worth nothing that there is special concept for preventing SQL injection - the concept of prepared statement. This is a kind of protection mechanism that allows create special kind of SQL query templates that will be configured and run by the application using input parameters.

There are two main advantages:

• Such query can be run as many times as necessary, while preparing a pattern only once. This means that prepared statements use fewer resources and thus run faster.
• The parameters to prepared statements don’t need to be quoted (it will be done automatically).

However, if other portions of the query are being built up with unescaped input, SQL injection is still possible!