| Author: sappi 07 Oct 2008 | Member Level: Gold | Rating: Points: -20 |
An attack technique used to exploit web sites by altering backend SQL statements through manipulating application input."
SQL Injection happens when a developer accepts user input that is directly placed into a SQL Statement and doesn't properly filter out dangerous characters. This can allow an attacker to not only steal data from your database, but also modify and delete it. Certain SQL Servers such as Microsoft SQL Server contain Stored and Extended Procedures (database server functions). If an attacker can obtain access to these Procedures it may be possible to compromise the entire machine. Attackers commonly insert single qoutes into a URL's query string, or into a forms input field to test for SQL Injection. If an attacker receives an error message like the one below there is a good chance that the application is vulnerable to SQL Injection
|
| Author: satyavani.namburu 07 Oct 2008 | Member Level: Bronze | Rating: Points: -20 |
SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. We can execute arbitrary SQL queries and/or commands on the backend database server through the Web application.
|
| Author: karthikeyan-The Great 07 Oct 2008 | Member Level: Gold | Rating: Points: -20 |
SQL injection is a technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.
|
| Author: Ankit 07 Oct 2008 | Member Level: Gold | Rating:  Points: 3 |
In Broader tearms SQL Injections are used by intruders to crash your application. For Example '<string value>' this is how SQL Server understand that, sent value is string but ' in between of string will be treated as string termination and can be a cause for crash.Like wise if serach can accept this then i will start giving you wrong results.
|