SQL Injection The SQL Injection is a code penetration technique that might cause loss to our database. It is one of the most practiced web hacking techniques to place malicious code in SQL statements, via webpage input. SQL injection can be used to manipulate the application's web server by malicious users. SQL injection generally occurs when we ask a user to input their username/userID. Instead of a name or ID, the user gives us an SQL statement that we will unknowingly run on our database. For Example - we create a SELECT statement by adding a variable "demoUserID" to select a string. The variable will be fetched from user input (getRequestString). demoUserI = getrequestString("UserId"); demoSQL = "SELECT * FROM users WHERE UserId =" +demoUserId; Types of SQL injection attacks SQL injections can do more harm other than passing the login algorithms. Some of the SQL injection attacks include: Updating, deleting, and inserting the data: An attack can mo...
Comments
Post a Comment
Please do not enter any spam link in the comment box.