Hacking websites with SQL Injection 💉

[b6]

What is SQL Injection ?

---

SQL Injection is a attack against websites / web applications which are using SQL Database.

Simply, Hacker will insert malicious SQL command and takeover the database.

How Does it Work?

---

Let's say, You have a code like this,

<?php

       $username = $_POST['username'];
       $password = md5($_POST['password']); 
       $sql = "SELECT * FROM `users` WHERE username = '$username' AND password = '$password'";
       
?>

If user input,
Username : admin
Password : admin123

The SQL will looks like,

SELECT * FROM `users` WHERE username = 'admin' AND password = '0192023A7BBD73250516F069DF18B500'

It will works fine,

---

But If user input,

If your input,
Username : admin' OR 1 = 1 --
Password : admin123

The SQL will looks like,

SELECT * FROM `users` WHERE username = 'admin' OR 1 = 1 --' AND password = '0192023A7BBD73250516F069DF18B500'

Here you can see, The password query will be commented (Will not Execute).
And 1 = 1 is always true, The hacker can get all the information of Users.

They can delete or change any record too.

Click Here | Watch SQl Injection tutorial

SQL Injection Strings

Click Here | Some injection Strings

---

How to prevent SQL Injections?

Nowadays, Most of the back-end frameworks handle injections itself. But If you don't use any frameworks, You can do it manually.

Every language has built-in functions for handle SQL injections while binding data.

PHP
PyTHON
.NET
NodeJS
Java

[dev_lak]

very informative bro...

[b6]

@dev_lak :+1:

[root]

This is awesome bro, nice example . Thanks

[b6]

@root :grinning: :grinning:

[GeethOnion]

Awesome😍

[b6]

@GeethOnion 👌👌👌👌

[ciaompe]

Awesome, we want this kind of articles. Thanks

[b6]

@ciaompe :+1: :+1:

[Nubelle]

useful b6 keep it up

[b6]

@Malith ✌️✌️✌️