What Is SQL Injection?

SQL Injection Principles

SQL injection is a type of attack that exploits vulnerabilities in web applications. Adversaries use this technique to construct dynamic SQL queries and insert malicious code into user input fields. This code tricks databases into executing SQL commands, which can result in the theft, tampering, or sabotage of sensitive data, or in some cases the execution of dangerous system-level commands on database hosts. Most websites and web applications need to use SQL databases. This is why SQL injection attacks are one of the oldest and most widely used web attacks.

For example, when we visit a website, we usually need to enter the login information. This is a web form. Its purpose is to collect specific types of data, such as usernames, passwords, and verification codes, and check the data against the database. If the data matches the database, the user is authorized to access the data. Otherwise, the user is denied access.

However, most web forms cannot prevent additional information from being entered on the forms. Adversaries can exploit this vulnerability to construct special input parameters to deceive the database into executing SQL commands and infiltrate the system.

Assume that the login page constructs a dynamic SQL statement by concatenating character strings, and then checks whether the username and password exist in the database. The background SQL statement is as follows:

select * from users where user='&username&' and pass='&password&'

If an adversary uses admin as the username and 1' or 'a'='a as the password, the query is as follows:

select * from users where user='admin' and pass='1' or 'a'='a'

According to the calculation rule (calculate "and" and then "or"), the final result is True. The adversary successfully bypasses the login verification phase and gains access to background data.

SQL Injection Types

SQL injection can be classified into three types based on how attackers access the database:

Huawei WAF5000 Web Application Firewall

Web services have become the most extensively utilized on the Internet. A plethora of online application services — including portal websites, online transaction systems, sign-up systems, and mailboxes — heavily depend on web services. However, these web service systems are not thoroughly evaluated and may have numerous security risks.

Successful SQL injection attacks may result in serious, irrevocable consequences, such as sensitive data breach, loss of user trust, and reputational damage. To address the security threats faced by web service systems, Huawei launched the WAF5000 web application firewall.

The WAF5000 series is a professional web application firewall developed by Huawei for governments, enterprises, and ISPs. It has the following advantages:

• Uses the unique behavior status chain detection technology to accurately identify attacks such as SQL injection, file injection, and command injection.
• Provides bidirectional content detection capabilities to identify sensitive information on server pages and take measures based on policies to prevent sensitive information leaks.
• Focuses on the security protection of dynamic applications. The built-in static anti web defacement and warning functions prevent defaced pages from being displayed on the client and generate alarms in a timely manner.
• Uses the whitelist and blacklist rule-based detection engines for collaboration, effectively addressing false negatives and false positives.
• Offers intelligent collaboration and millisecond-level locking to effectively reduce intrusion risks, meet PCI and Classified Protection requirements, as well as internal control norms for enterprises, and ensure secure running of web application services.