Website Security and SQL Injections

One of the most devious ways of infiltrating a website is through SQL Injections, which in general is where un-sanitised user input allows a malicious user to ‘inject’ their own SQL statements into your SQL queries. Of course this is incredibly dangerous as depending on the level of security, a user could potentially delete entire databases, give themselves administrator permissions, and steal data. It can also cause problems due to apostrophes within some people’s names. This makes SQL Injection a very serious concern for any competent Web Developer or Consultant. The site http://www.unixwiz.net/techtips/sql-injection.html has an incredibly interesting walk-through of using SQL Injection to break into a client’s site in a security review of their site.

As the article discusses, SQL Injection won’t work every time and does involve a little bit of guess work when guessing database field names, although important field names generally look similar, the password field will typically be called ‘password’ and the email field will be called something like ‘email’ or ‘mail’. However once all this is figured out, using SQL Injection will lead to be quick results.

Finally, the article discusses the virtues and methods of giving your website security /SQL Database from SQL Injections, advocating techniques like sanitisation of input where you remove all special characters that can be used to perform SQL Injections like apostrophes and so on. It goes on to mention using database permissions and configuring error reporting. Error reporting is especially important as if a malicious attacker is able to see the SQL errors that occur from their SQL Injection attempts it can allow them to easily tailor their later injections to avoid errors. In the end, you could luck out and have no user attempt to use SQL Injection, but this blog has reported that "the observed Web applications suffered on average 71 SQLi attempts an hour." so in the end it is worth the time of a Web Developer or Consultant to provide website security against SQL Injections.