06 - SQL Injection

  Structured Query Language

  Simplified Question Lingo

  Samsung Quip Language

  Sentient Quotient Lizard

  used to structure questions and post them on the internet

  used for creating games

  used by hackers, and only by hackers

  used in programming and designed for managing data held in a relational database management system (e.g. one linked to a website)

  TRUE

  FALSE

  …..called tblStaff for only the staff who are in the London Office

  ….called tblLondon where all staff are located

  There are no tables being referred to in this code

  ….that is called the "London Office"

1 .SQL injection is a code injection technique that might destroy your database.

2. SQL injection is one of the most common web hacking techniques.

3. SQL injection is the placement of malicious code in SQL statements, via web page input.

  Only 1 is true

  Only 1 and 3 are true

  They are all true

  None of them are true

  The user uses physical ink to inject and corrupt your database

  The user uses python programming code to hack into your mysql database

  The user enters the phrase "sql injection" into the field, which will delete your database

   the user gives you an SQL statement that you will unknowingly run on your database.

  create an SQL statement that prevents a hacker

  create an SQL statement that allows zero input

  create a text input box

  create an SQL statement to select a user, with a given user id.

If there is nothing to prevent a user from entering "wrong" input, the user can enter some "sly" input like shown in the image. The SQL above is valid and will return ALL rows from the "Users" table, since OR 1=1 is always TRUE.

  This could never be dangerous

  The "Users" table could contain names and passwords that the hacker may then see.

  The "Users" table could be instantly deleted

  The "Users" table could inject the hacker's own machine in a reverse attack

  FALSE

  TRUE

  because the SQL would be invalid and would do nothing

  because the SQL would be valid and will return all rows from the "Users" table, since OR ""="" is always TRUE.

  because the SQL would cause the entire contents of the database to be corrupted

  because the SQL has entered rubbish, and the integrity of the database data will be affected.

Most databases support batched SQL statement.
A batch of SQL statements is a group of two or more SQL statements, separated by semicolons.
The SQL statement below will return all rows from the "Users" table, then delete the "Suppliers" table.

  * FROM Users; DROP TABLE 

  SELECT FROM All; DROP TABLE Suppliers

  SELECT * FROM Users; DROP TABLE Suppliers

  SELECT * FROM; DO TABLE Suppliers

  SELECT * FROM Users WHERE UserId = 105;

  SELECT * FROM Suppliers WHERE UserId = 105; DROP TABLE Users;

  SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers;

  DROP TABLE Suppliers;

  parameters

  parentheses

  prolife

  prayers

The SQL engine checks each parameter to ensure that it is correct for its column and are treated literally, and not as part of the SQL to be executed.

  FALSE

  TRUE

SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.

  TRUE

  FALSE

  TRUE

  FALSE

  TRUE

  FALSE

  TRUE

  FALSE

  True

  False

*Note: the simple answer for how to prevent an SQL injection is: The server side code must carefully validate the input information before the SQL request is formed. (e.g. the username and password may only be a certain length or would not allow spaces etc.)

  extra SQL commands into the input boxes, hoping these commands will be carried out by the server

  blank spaces to delete the database

  extra SQL commands that are typed directly into the server's database to corrupt it

  sql code to damage the website