What Is SQL Injection and How It Works ?

sql injection

Before diving into actual topic,it is good to know what is SQL!

SQL referred as Structured Query Language. It is a language which is used to interact with database such as manupulating the data in the server.

Generally, In SQL, data stored in database represented in tables. 

To be more clear, These tables have ROWS and COLUMNS.

Where :

• ROWS - represents Type Of Information stored.
• COLOMNS - represents Information stored.

So now you know what is SQL. YOu might thinking how the data is being manupulated in the database. Well!

SQL database uses some commands to manupulate the data in the server. Umm don't confuse.

Lets take a look at these SQL commands and see what they does.

• CREATE - It create tables in the database.
• SELECT - It is used to retrieve data from tables.
• INSERT - It is used to insert data into tables.
• DELETE - It is used to delete data from the table.
• UPDATE - It is used to update the data in the table.
• RENAME - It is used to rename tables in database.
• GRANT  - It is used provide access privileges on the database.
• REVOKE - It is used to remove access or privileges in database.
• ALTER  - It is used to modify database objects.
• DROP   - It is used to remove or delete database objects.

I believe now you have a brief idea about SQL. Ahh cool!
Lets take an example of each command.


1. CREATE DATABASE codextech;

   It creates a database named with codextech.

2. SELECT * FROM people;

   It select everything from the table people.

3. INSERT INTO people;

    It inserts data into table people.

4. DELETE FROM people WHERE person_name='Tony Stark';

   It deletes column Tony Stark from table people. 

5. DROP TABLE people;

  It drops the table people. Means table people will disappear from    database.

How SQL injection works?

Using SQL injection attacker can inject malicious SQL commands into SQL statements to manupulate the data.

SQL injection is one of the most dengerous attacks used on Web Applications whose database uses SQL to handle data on the server.

Attacker can exploit web applications triggering SQL commands and can gain unauthorized access to the server so that attcker can modify, delete, insert data into database.

SQL injection is not possible if a coder write clean code and sanitize them.

Lets see how SQL injection works in real life scenarios.

Here is a simple example wriiten in php. 
This is how a server responds to the user input.

 $Uname = $_POST['name'];

 $Upassword = $_POST['password'];

Now, lets see how it can be exploited using SQL injection.

$sql = "SELECT id from users where username = 'Uname' && password = 'Upassword' ";

The above query can be used to retrieve User name and Password from the database.

To execute the above sql command,we use database.execute() function.

database.execute($sql);

This is how the user’s authentication is verified by the database server.

In most of the real life scenarios, hacker inject payload(Malicious code) into sql statement in the place of usernames and passwords to retrive credentials.

This is how some payloads look like

” or true
” or “”=”
” or 1–
” or “x”=”
’ OR '1'='1'

Attacker can replace password field in the query with the above payloads.

SELECT id FROM users WHERE username=’username’ AND password=’password’ OR 1=1’

This is how a hacker can inject SQL queries into database to retrieve sentisive data like usernames and passwords.

gjbkhvbhhc