Database System Implementation CSE 507 SQL Injection Database System Implementation CSE 507 Presented By: Manisha Sharma (MT15031) and Kanupriya Batra (MT15025)

Introduction When SQL is used to display data on webpages, it is common to let users enter their search values. txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId; User Name : testUser Password : *****

SQL Injection - Definition Technique where malicious users can inject SQL commands into an SQL statement via web input. Injected SQL commands can alter SQL statements and compromise the security of the web application.

SQL Injection based on 1=1 is always true 1501 or 1=1 User Name : Server Result : Retrieves all the rows from the table Users. What if the table contains the passwords?? Select * from Users where userid = 1501 or 1=1

sql injection based on Batched SQL Statements Databases support batched SQL statement, separated by semicolon. Example: User id : Result : SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers Returns all rows from table Users and then delete the table Suppliers . You can prevent SQL injection if you adopt an input validation technique in which user input is authenticated against a set of defined rules for length, type and syntax and also against business rules. 105; DROP TABLE Suppliers

SQL Injection Prevention Ways

Need to prevent SQL Injection SQL Injection vulnerability is one of the popular security breaches in applications' software which is easy to implement if security measure has not been taken during code implementation.

Ways to prevent SQL Injection Using JAVA Prepared Statements (with Parameterized Queries) Parameterized queries force the developer to first define all the SQL code, and then pass in each parameter to the query later. PreparedStatement stmt = connection.prepareStatement("SELECT * FROM users WHERE userid=? AND password=?"); stmt.setString(1, userid); stmt.setString(2, password); ResultSet rs = stmt.executeQuery(); This code is not vulnerable to SQL Injection because it correctly uses parameterized queries, bind variables (i.e. the question marks) and the corresponding setString methods.

Ways to prevent SQL Injection Providing Least Privilege minimize the privileges assigned to every database account in your environment Do not assign DBA or admin type access rights to your application accounts Rarely, if ever, grant create or delete access to database accounts. Stored Procedure These are designed to pass a password in, but it will never be put in any result set.  The stored procedures for registering and authenticating a user for the website might be: RegisterUser VerifyCredentials ChangePassword Validate data if the stored procedure is going to use EXEC(some_string)

Ways to prevent SQL Injection Cleaning and Validating input Used to detect unauthorized input before it is passed to the SQL query provides way to enter surnames such as "O'Brian" or "D'Arcy“ (avoiding injection) user may want to enter numbers in an application, sometimes leads to security breach. It is therefore required that the input from the user is checked and validated to determine that it really is a number, and in the valid range.

Conclusion With security threats increasing day by day, it’s high time to focus on these threats and ways and methods to prevent them

Thank you Kanupriya Batra, Manisha Sharma