Ashish Gharti and Bijay Limbu Senihang are founders of Nep Security and IT security researchers who consult for Entrust Solution Nepal. SQL injection occurs when an attacker can influence SQL queries an application passes to a database, potentially allowing data leakage, site defacement, malware infection, or spear phishing. Defenses include addslashes(), mysql_real_escape_string(), is_numeric(), sprintf(), and htmlentities().

1. BY:- Ashish Gharti
Bijay Limbu Senihang

2.  Founder of Nep Security
www.nepsecurity.org
www.facebook.com/groups/nepsec
 IT Security Researcher
 Information Security Consultant at Entrust
Solution Nepal.

3.  The vulnerability that results when you
give an attacker the ability to influence the
Structured Query Language (SQL) queries
that an application passes to a back-end
database.

4.  Poorly Filtered Strings
 Incorrect Type Handling
 Signature Evasion
 Filter Bypassing
 Blind SQL Injection

5.  Data Leakage.
 Embarrassment (Site Deface)
 Malware Infection.
 Medium for Spear Phishing.

7.  addslashes ()
 mysql_real_escape_string()
 is_numeric()
 sprintf()
 htmlentities($var, ENT_QUOTES)