Difference between revisions of "Oracle Security: SQL Injection"

From Robs_Wiki
Jump to: navigation, search
(Created page with "__TOC__ == What is SQL Injection ? == SQL injection is a technique to maliciously exploit applications that use client-supplied data in SQL statements. Attackers trick the SQ...")
 
(How does SQL Injection take place?)
Line 4: Line 4:
 
SQL injection is a technique to maliciously exploit applications that use client-supplied data in SQL statements. Attackers trick the SQL engine into executing unintended commands by supplying specially crafted string input, thereby gaining unauthorized access to a database in order to view or manipulate restricted data.<br /><br />
 
SQL injection is a technique to maliciously exploit applications that use client-supplied data in SQL statements. Attackers trick the SQL engine into executing unintended commands by supplying specially crafted string input, thereby gaining unauthorized access to a database in order to view or manipulate restricted data.<br /><br />
 
== How does SQL Injection take place? ==
 
== How does SQL Injection take place? ==
Incorrectly validated or nonvalidated string literals are concatenated into a dynamic SQL statement, and interpreted as code by the SQL engine.
+
Incorrectly validated or nonvalidated string literals are concatenated into a dynamic SQL statement, and interpreted as code by the SQL engine. The code passage below is an example of code that is vulnarable for SQL Injection:
 +
<pre>
 +
Stmt CONSTANT VARCHAR2(4000) :=
 +
'select email from employees
 +
where email = '''|| p_email|| '''
 +
and last_name = ''' ||p_last_name || '''';
 +
</pre>

Revision as of 08:49, 28 January 2020

What is SQL Injection ?

SQL injection is a technique to maliciously exploit applications that use client-supplied data in SQL statements. Attackers trick the SQL engine into executing unintended commands by supplying specially crafted string input, thereby gaining unauthorized access to a database in order to view or manipulate restricted data.

How does SQL Injection take place?

Incorrectly validated or nonvalidated string literals are concatenated into a dynamic SQL statement, and interpreted as code by the SQL engine. The code passage below is an example of code that is vulnarable for SQL Injection:

Stmt CONSTANT VARCHAR2(4000) :=
'select email from employees 
where email = '''|| p_email|| ''' 
and last_name = ''' ||p_last_name || '''';