As you've seen so far, SQL injections are very dangerous and also they're very easy to occur and very
easy to find.
You'll find them everywhere in some really famous websites.
People try to prevent these vulnerabilities using filters.
Filters can make it look like there is no exploit.
But if you actually try harder by using encoding different types of encoding or using a proxy, then
you'll be able to bypass most of these filters.
Some programmers use a blacklist, so for example, they prevent the use of union, they prevent the
use of insert and stuff like that.
Again, it's not 100% secure.
It can be bypassed using a white list exactly the same issues as the blacklist.
The best way to do it is to program your web application in a way that it does not allow code to be
injected into it and then execute it.
So the best way to do that is to do to use parameterized statements where the data and the code is separated.
And the best way to show you what I mean by that is using an example.
I'm keeping the least amount of programming in this example.
I don't want it to be a programming example.
There's actually mistakes in the programming in there, but I'm trying to give you the concept more
than how to program it.
So the vulnerable code that we were looking at used to do this, so it used to do select star from accounts
where username is equal to whatever we put in text box one.
And then we used to put in text box one.
Let's just put it here.
We used to say admin and then close the quote.
And then we're able to do a union, select and execute something else.
And then once we're done, we used to add the comment which basically ignores everything that comes
in after it.
So when you copy this.
And you paste it in here.
You'll see what's happening.
So it's selecting.
Now, let's just get rid of this.
Because this is just making the colors not nice.
Now, we're actually going to just put a comment on this.
So.
It's going to do a select start from accounts where username is equal to admin union, select and execute
whatever we want to do.
This is very bad and it's very hard to protect against.
As I said, using filters and stuff will only hide the problem will not fix it.
The best way to do this is using the parameter statements just like so.
So this is the safe way to do it.
First of all, you prepare your statement.
Most languages like PHP and all of them, they actually have a function like that.
And you can prepare select style from accounts where a username is equal to question mark.
And then you send the values.
So PHP now knows the SQL statement is select staff from accounts where username is equal to something
and then it's going to take the value of textbox one.
So even if we come in and we use our very sneaky statement right here.
And paste it in there.
The Web application will know that the value for this is admin union select.
So it will actually try to go and select staff from accounts where the username and then it actually
it will add its own quotes and they try to find a username with the following username.
So this whole thing will be executed like so.
So it will be select start from accounts where username is equal to admin union.
Select this hashtag so it'll never whatever you put in your.
TextBox will be sent as a value and the web application will know that this is a value.
It's not a code, and it will never execute it.
Therefore, this will protect you against SQL injections.
You can use the filters as a second line of defence, and I also advise that you use the least privileges
possible.
So use for each database.
Use one user with the least amount of privileges they want.
So don't allow the users to do anything that they want.
Allow them.
If it's a simple website that only does selection, then only allow the user to select.
If it only needs to select an insert, then only allow them to select an insert.
And this is a rule you should keep with everything.
Even with Linux systems, make sure that the permissions are always as least as possible.
Each user don't have any extra permissions that they don't need.