1. Chapter 13
Security Methods
Part 3

2. SQL Injection Attack Many web applications take user input from a form
Often this user input is used literally in the construction of a SQL query submitted to a database. For example:
SELECT user FROM table WHERE name = ‘user_input’;
An SQL injection attack involves placing SQL statements in the user input
12/27/2018
Web Security

3. Login Authentication Query
Standard query to authenticate users:
select * from users where user='$usern' AND pwd='$password'
Classic SQL injection attacks
Server side code sets variables $username and $passwd from user input to web form
Variables passed to SQL query
select * from users where user='$username' AND pwd='$passwd'
Special strings can be entered by attacker
select * from users where user='M' OR '1=1' AND pwd='M' OR '1=1'
Result: access obtained without password
12/27/2018
Web Security

4. Some improvements … Query modify:
select user,pwd from users where user='$usern‘
$usern=“M' OR '1=1”;
Result: the entire table
We can check:
only one tuple result
formal correctness of the result
$usern=“M' ; drop table user;”?
12/27/2018
Web Security

5. CIT 380: Securing Computer Systems
SQL Injection
Attacker
App sends form to user.
Attacker submits form with SQL exploit data.
Application builds string with exploit data.
Application sends SQL query to DB.
DB executes query, including exploit, sends data back to application.
Application returns data to user.
User
‘ or 1=1--
Pass
Firewall
Web Server
DB Server
CIT 380: Securing Computer Systems

6. SQL Injection in PHP
$query = "select count(*) from users where username = '$username' and password = '$password'";
$result $query);
CIT 380: Securing Computer Systems

7. SQL Injection Attack #1 Unauthorized Access Attempt:
password = ’ or 1=1 --
SQL statement becomes:
select count(*) from users where username = ‘user’ and password = ‘’ or 1=1 --
Checks if password is empty OR 1=1, which is always true, permitting access.
CIT 380: Securing Computer Systems

8. SQL Injection Attack #2 Database Modification Attack:
password = foo’; delete from table users where username like ‘%
Database executes two SQL statements:
select count(*) from users where username = ‘user’ and password = ‘foo’
delete from table users where username like ‘%’
Principle of Least Privilege likely violated as web server user needs privileges to do all operators permitted on users, including deleting them.
CIT 380: Securing Computer Systems

9. Preventing SQL Injection Attacks
mysqli_real_escape_string()
Prepared statements

10. post_message.php Script 13.6 on pages 444-5
ch13\post_message.php

11. Assignment #22