This document discusses SQL injection and techniques to prevent it. SQL injection occurs when malicious SQL statements are inserted into an entry field to exploit vulnerabilities in the underlying database. Attackers can use SQL injection to bypass login screens or retrieve sensitive data. To prevent SQL injection, developers should escape special characters in user input before submitting queries, use prepared statements with bound parameters, and validate and sanitize all input. Input escaping involves using database-specific escape functions like mysql_real_escape_string() to avoid unintended SQL commands. Proper input validation and escaping helps prevent SQL injection attacks.

1. SQL injection prevention
techniques
EGCO 627: Web Penetration Testing
Mahidol University

2. What is SQL injection?
An SQL injection is a technique that attackers apply to insert SQL query
into input fields to then be processed by the underlying SQL database.
These weaknesses are then able to be abused when entry forms allow
user-generated SQL statements to query the database directly.
“OR 1=1”

3. What is SQL injection? (Cont.)
To give you a typical scenario, take a typical login form consisting of a
user/email field and a password field. After the login info is submitted,
it is combined with an SQL query on your web server. In PHP, the
command is written in the following way:

4. What is SQL injection? (Cont.)
It is sent to the server to verify if it was given a valid username with a
corresponding password. A username “admin” with the “admin1234”
password would result in this command:

5. What is SQL injection? (Cont.)
It will then return user data that was entered in the password field. This
move could allow the login screen to be bypassed. An attacker can also
go further by adding another select condition, ‘OR 1=1’, that will result
in the following query:

6. What is SQL injection? (Cont.)
พิสูจน์ตัวตนปกติ พิสูจน์ตัวตนSQLi

7. SQL Injection - Information Gathering (Cont.)
So I browsed it and I could see this:

8. SQL Injection - burp suite scan

9. SQL Injection Authentication Bypass Cheat Sheet
or 1=1
or 1=1--
or 1=1#
or 1=1/*
' or'1'='1
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/

10. How to prevent SQL injection attacks
SQL injections are one of the most utilized
web attack vectors, used with the goal of
retrieving sensitive data from organizations.
When you hear about stolen credit cards or
password lists, they often happen through
SQL injection vulnerabilities. Fortunately,
there are ways to protect your website from
SQL injection attacks.

11. SQL injection preventaion techniques
Escaping
Always use character-escaping functions for user-supplied input
provided by each database management system (DBMS). This is done
to make sure the DBMS never confuses it with the SQL statement
provided by the developer.

12. SQL injection preventaion techniques (Cont.)
For example, use the mysql_real_escape_string() in PHP to avoid
characters that could lead to an unintended SQL command. A modified
version for the login bypass scenario would look like the following:

13. SQL injection preventaion techniques (Cont.)
Previously, your code would be vulnerable to adding an escape
character () in front of the single quotes. However, having this small
alteration will protect against an illegitimate user and mitigate SQL
injection.

14. SQL injection prevention techniques (Cont.)
input user มาสร้าง query แล้วยิงลง database ตรงๆ โดยไม่มี escape ใดๆ

15. SQL injection prevention techniques (Cont.)
Escape user input

16. DEMO

17. Referent
• https://www.ptsecurity.com/ww-en/analytics/knowledge-base/how-to-prevent-sql-injection-
attacks/
• https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

18. Present BY:
• Songchai Duangpan 6136896
• Phattarapon Maprasert 6136187