SQL Injection.

What is SQL injection?

SQL injection is an attack on an application that uses a database. The attacker types database commands into a place where the application expects plain input, such as a form field. If the application is not built safely, it runs those commands against its database.

SQL stands for Structured Query Language. It is the language many databases use to read and change data. OWASP, a nonprofit group focused on application security, describes a SQL injection attack as the insertion, or injection, of a SQL query via the input data from the client to the application.

How does SQL injection work?

The problem starts when an application builds a database query by joining text typed by a user with its own query text. OWASP calls this string concatenation. The database can then treat the typed text as part of the query.

Here is a simple illustration from OWASP. A user types name’ OR ‘a’=’a into a field. When this is joined into the query, the OR condition makes the filter always true. The query then returns all records, not only the ones the user should see.

What can an attacker do with it?

OWASP says a successful attack can let an attacker read sensitive data from the database and modify data by inserting, updating or deleting it. It can also let them run administration operations on the database. They may recover the content of a file on the database system. In some cases they can issue commands to the operating system.

OWASP also lists four areas that are affected. Confidentiality is hit when private data is exposed. Authentication is hit when password checks are bypassed by changing the query logic. Authorization is hit when access control data stored in the database is altered. Integrity is hit when data is changed or deleted.

How can SQL injection be reduced?

OWASP recommends prepared statements with variable binding, also called parameterized queries. OWASP shows them separating the SQL structure from the data with placeholders.

The OWASP prevention cheat sheet lists other defenses too:

• Stored procedures, when they are written safely and do not build dynamic SQL inside.
• Allow-list input validation for parts of a query that cannot use bound values, such as table or column names.
• Least privilege, which means giving the database account only the permissions the application needs.

The same cheat sheet strongly discourages escaping user input as a main defense. It calls that method fragile compared with the others.

Why does CISA still talk about it?

CISA says SQL injection defects have been documented over the past two decades. It says manufacturers keep shipping products with this defect, which puts many customers at risk. CISA cites research that has called it an “unforgivable” vulnerability since at least 2007, and says SQL vulnerabilities such as CWE-89 are still a prevalent class of vulnerability.

Is SQL injection the same as a data breach?

No. SQL injection is a flaw and a method of attack. A data breach is an outcome, where data is exposed to people who should not see it. An injection attack can be one way to reach that outcome, since OWASP says it can be used to read sensitive data.

Is SQL injection the same as remote code execution?

Not exactly. SQL injection targets the database through the application. OWASP says that in some cases it can also lead to commands on the operating system. Remote code execution is the broader idea of running code on a system you do not control.