executed in the database by the server:

SELECT * FROM userinfo WHERE userid = “ + id_variable + “ ; ”

where id_variable is an input taken from the user.

But, if this user-provided variable is not properly checked for type constraints, the attacker can take advantage of that.

An attacker can input,

1 ; DROP TABLE userinfo

As a result, the server will be tricked to execute the following query in the database :

SELECT * FROM userinfo WHERE userid = 1 ; DROP TABLE userinfo ;

As a result, the userinfo table is deleted from the database.

Example 4: Let’s suppose, for the URL http://bookreview.com/review.php?ID=5

The server executes the following query in the database :

SELECT * FROM bookreviewinfo WHERE bookid = “ + id_variable + “ ; ”

Suppose the attacker loads the following URL :

http://bookreview.com/review.php?ID=5 OR 1=1

If proper care is not taken, the following query will be executed in the database :

SELECT * FROM bookreviewinfo WHERE bookid = 5 OR 1 = 1;

And then, the attacker loads this URL :

http://bookreview.com/review.php?ID=5 AND 1=2

If proper care is not taken, in the first case, reviews of all books will be shown. And, in the second case, an error page will be shown.

However, this will give enough information to the attacker to know that the application is vulnerable to SQL Injection Attacks. So, now he can proceed forward to do some more experiments to get the version of SQL running on the server, etc.

And the attacker can plan for even more attacks.

Example 5: Suppose, in a web application, a user authenticates himself with username and password. And he has sensitive data stored in his account on the website.

Let’s assume, John is a registered user on the website with his username to be ‘john’.

So, when he logs in, the server will execute the following query to fetch his data:

SELECT * FROM users WHERE username = ‘ john ‘ ;

Suppose an attacker registers on the website with a username “john’–” and a different password.

So, when the attacker logs in, the following query will be executed:

SELECT * FROM users WHERE username = ‘ john ‘ –‘ ;

Please note that ‘–‘ indicates that the comments and the characters after ‘–‘ will be ignored while executing the query and thus it will avoid getting syntax errors for trailing ( ‘ ) while executing the query.

So, the sensitive information of John will be displayed to the attacker.

The attacker can even go a step forward and change John’s password or steal sensitive data like …