- published: 09 Oct 2013
- views: 601148
SQL injection is a technique often used to attack databases through a website. This is done by including portions of SQL statements in a web form entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database (e.g. dump the database contents to the attacker). SQL injection is a code injection technique that exploits a security vulnerability in a website's software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
In operational environments, it has been noted that applications experience, on average, 71 attempts an hour. When under direct attack, some applications occasionally came under aggressive attacks and at their peak, were attacked 800–1300 times per hour.
Hacking Websites with SQL Injection - Computerphile
SQL Injection Explained
SQL Injection Basics Demonstration
DEFCON 17: Advanced SQL Injection
[TuT] How To Hack A Website Using SQL Injection
Step-by-step SQL injection guide to bypassing basic login screen - Mastering SQL injection
SQL Injection - Simply Explained
What is SQL Injection Attack
Step-byStep SQL Injection Attack (HQ)
Basic SQL Injection Guide