Hi,
This is a continuation of my previous post on website security. In this I will be discussing about SQL injection and spamming web forms. So coming to SQL injection.
1. SQL Injection
SQL Injection is possibly one of the easiest way for a professional hacker to tamper your database. The idea is to customize the internal SQL query according to the hackers choice. This happens when the users input from textbox/textarea are not filtered before executing them in a SQL query. This might sound a little complicated, but the solution to it is not. Consider the following query:
mysql_query("SELECT * from employees where username='".$_POST['user_name']."'");
The above statement simply takes the input entered in a text box, "user_name" and binds it in a SQL query. Now in case of SQL Injection, assume the value of $_POST['user_name'] is entered as:
' or '1'='1
So the final query becomes:
This is a continuation of my previous post on website security. In this I will be discussing about SQL injection and spamming web forms. So coming to SQL injection.
1. SQL Injection
SQL Injection is possibly one of the easiest way for a professional hacker to tamper your database. The idea is to customize the internal SQL query according to the hackers choice. This happens when the users input from textbox/textarea are not filtered before executing them in a SQL query. This might sound a little complicated, but the solution to it is not. Consider the following query:
mysql_query("SELECT * from employees where username='".$_POST['user_name']."'");
The above statement simply takes the input entered in a text box, "user_name" and binds it in a SQL query. Now in case of SQL Injection, assume the value of $_POST['user_name'] is entered as:
' or '1'='1
So the final query becomes:
