SQL Injection Tutorial — Step-by-Step Guide with Examples | Vaarta

What is SQL Injection?

SQL injection (SQLi) is a code injection technique that exploits security vulnerabilities in database-driven applications. It occurs when user input is inserted into SQL queries without proper sanitization.

Why SQL Injection is Dangerous

How SQL Injection Works

Basic Authentication Bypass

**Vulnerable Code**:

```sql

SELECT * FROM users WHERE username = '$input' AND password = '$pass'

**Attack Input**:

Username: admin' OR '1'='1' --

Password: anything

**Resulting Query**:

```sql

SELECT * FROM users WHERE username = 'admin' OR '1'='1' --' AND password = 'anything'

The `--` comments out the password check, and `OR '1'='1'` is always true.

Union-Based SQLi

**Attack**:

' UNION SELECT username, password FROM users --

**Result**: Returns all usernames and passwords

Error-Based SQLi

**Attack**:

' AND 1=CONVERT(int, (SELECT TOP 1 table_name FROM information_schema.tables)) --

**Result**: Database structure leaked through error messages

Blind SQLi

**Attack**: Boolean-based

' AND 1=1 -- (true - page loads normally)

' AND 1=2 -- (false - page behaves differently)

**Attack**: Time-based

'; WAITFOR DELAY '0:0:5' -- (5 second delay if vulnerable)

Real-World Examples

Heartland Payment Systems (2008)

Sony Pictures (2011)

TalkTalk (2015)

Detection Methods

1. Manual Testing

Try these inputs in login forms:

' OR '1'='1

admin' --

' UNION SELECT NULL --

2. Automated Tools

3. Code Review

Look for:

Prevention

1. Parameterized Queries (Best)

```python

cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

2. ORM Usage

```python

User.objects.filter(username=username)

3. Input Validation

```python

if not re.match("^[a-zA-Z0-9_]+$", username):

raise ValueError("Invalid username")

4. Stored Procedures

```sql

CREATE PROCEDURE GetUser @username NVARCHAR(50)

AS

SELECT * FROM users WHERE username = @username

Vaarta.space and SQLi

While our scanner focuses on DNS, SSL, and headers, understanding SQLi helps you:

Conclusion

SQL injection is preventable. Use parameterized queries, validate input, and test regularly.