SQL injection is a code injection technique used to attack data-driven applications by inserting malicious SQL statements into entry fields for execution, allowing attackers to dump database contents. It has been a top web application vulnerability for many years. SQL injection can occur when user inputs are used in SQL queries without validation or encoding. A second order SQL injection involves storing a malicious SQL statement for later execution, bypassing immediate validation. Mitigation techniques include using parameterized statements, input validation, and limiting database permissions.

1. SQL INJECTION
BY : CHANCHAL PARDESHI
MSIT/14/005.

2. WHAT IS SQL INJECTION?
• SQL injection is a code injection technique.
• Used to attack data-driven applications.
• Here malicious SQL statements are inserted into an entry field for execution (e.g.
to dump the database contents to the attacker).

3. WHY IS IT SO IMPORTANT?
• In a 2012 study, security company Imperva observed that the average web
application received 4 attack campaigns per month, and retailers received twice as
many attacks as other industries.
• SQL injection (SQLI) is considered one of the top 10 web application vulnerabilities
of 2007 and 2010 by the Open Web Application Security Project.
• In 2013, SQLI was rated the number one attack on the OWASP top ten.

4. IMPLEMENTATION
• Attacked on Queries that depends on user inputs.
• Incorrect type handling
• Second order SQL injection

5. SECOND ORDER SQL INJECTION
• Second order SQL injection occurs when submitted values contain malicious commands
that are stored rather than executed immediately.
• In some cases, the application may correctly encode an SQL statement and store it as valid
SQL.
• Then, another part of that application without controls to protect against SQL injection
might execute that stored SQL statement. This attack requires more knowledge of how
submitted values are later used.
• Automated web application security scanners would not easily detect this type of SQL
injection and may need to be manually instructed where to check for evidence that it is
being attempted.

6. MITIGATION
• Parameterized statements
• Pattern check
• Database permissions