SQL Injection

SQL Injection (SQLi)

# Vulnerable code (PHP)
$query = "SELECT * FROM users WHERE email = '" . $_POST['email'] . "'";
# Attack: email = ' OR '1'='1
# Result: SELECT * FROM users WHERE email = '' OR '1'='1'
# Returns ALL users!

# Attack 2: UNION-based extraction
# email = ' UNION SELECT username,password,null FROM users--
# Dumps all credentials

# Attack 3: blind boolean
# email = alice@test.com' AND SUBSTRING(password,1,1)='a'--

# DEFENCE 1: Parameterised queries (always use this)
# PHP PDO
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$_POST['email']]);

# Python
cursor.execute('SELECT * FROM users WHERE email = %s', (email,))

# DEFENCE 2: Input validation
if not re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}$', email):
    raise ValueError('Invalid email')

# DEFENCE 3: Least privilege DB user
# webapp user has SELECT, INSERT, UPDATE only
# NO DROP TABLE, NO FILE privileges