[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571616-105":53,"doc-detail-571616-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","sql-injection-an-in-depth-discussion-csci-476","SQL Injection - An In-Depth Discussion - CSCI 476","","SQL Injection covers how a software defect can become a security vulnerability when user input is inserted into database queries without proper controls. The material defines SQL, gives multiple query examples, and demonstrates an injection that forces a condition like '1'='1' to return many or all records. It also explains what the attacker learns from the application output and outlines mitigation via input validation, remediation, and avoiding SQL injection techniques.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/sql-injection-an-in-depth-discussion-csci-476/571616/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/sql-injection-an-in-depth-discussion-csci-476/571616.png","ImageObject",442,249,{"name":88,"@type":89},"Fans","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-24","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",8,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What defect leads to an SQL Injection vulnerability?","Question",{"text":109,"@type":110},"A software defect can create a security vulnerability, which is a weakness that enables certain attack types. One possible attack type is SQL Injection, so if the vulnerability allows those attacks, it is an SQL Injection vulnerability.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How does the example injection change the query results?",{"text":114,"@type":110},"The injected input alters the WHERE clause so that a condition such as '1'='1' becomes always true. That forces the query to return all (or a subset depending on the language) of the records instead of only the intended account.",{"name":116,"@type":107,"acceptedAnswer":117},"What information can the attacker gain from the application output?",{"text":118,"@type":110},"If the application prints whatever is contained in the query result variable, the attacker can see data returned by the database. Those results can provide valuable details for further attacks, such as targeting an account discovered from the injection.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},571616,1792083967,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":25},5909892330395,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","SQL Injection  \nAN IN-DEPTH DISCUSSION  \nCSCI 476  \nSQL INJECTION  \nAGENDA  \n• What is an SQL Injection vulnerability  \n• An example of SQL Injection  \n• An analysis of how it works  \n• How the attacker views the situation  \n• Input validation  \n• More attack vectors  \n• More remediation  \n• Avoiding SQL Injection  \nWhat Does Sql Injection Mean  \n• First, there is a software defect  \n• That defect results in a security vulnerability (or just vulnerability)  \n• A vulnerability is a weakness for certain types of attacks on the security of the application  \n• One of the possible attack types is an SQL Injection  \n• So, if you have a vulnerability that permits SQL Injection attacks, you have an SQL Injection vulnerability  \n• Why are we talking about this before we know more about security?  \nIntroduction  \nThe SQL Injection Attack  \n• SQL is “Structured Query Language”  \n• It is a standardized language for accessing databases  \n• Examples  \n• select name from employee where ssn=‘123456789’  \n• select name, ssn, dob from employee where ssn=‘123456789’ and id=‘31042’  \n• select code,name from products where code =‘536’ union select code,name from sales where code > ‘500’  \n• Every programming language implements SQL functionality in its own way  \nIntroduction  \nSQL Injection Example DB  \n\n| Accounts |  |  |  |\n| --- | --- | --- | --- |\n| Name | Account | UserId | Password |\n| Joe B | 1234 | joe | mypass |\n| Tom M | 6787 | Daisy | rover |\n| Alicia G | 2547 | alicia | x123y |\n| Sally B | 7744 | sal | yllas |\n\n\n| Balances |  |  |  |\n| --- | --- | --- | --- |\n| Account | Name | Cbalance | SBalance |\n| 2547 | Alicia G | 23.45 | 75.00 |\n| 1234 | Joe B | 67.84 | 0.00 |\n| 3333 | Justin D | 55.10 | 200.56 |\n| 6787 | Tom M | 99.21 | 71.55 |\n| 7744 | Sally B | 17.20 | 0.00 |\n| 8899 | Tom Q | 102.55 | 66.00 |\n\nIntroduction  \nSQL Injection Example …  \n• Assume that the select statement implemented is:  \nres = select CBalance from Balances where Acct=‘$acct’  \n• $acct is the variable containing the account number input by the user (PHP style naming )  \n• This is a typical usage of a select statement to look up a value  \n\n| Enter your account number | \u003Cbr>\u003Cbr>3215 |\n| --- | --- |\n| Your balance | |\n\n• Results in:  \nres = select CBalance from Balances where Acct=‘3215’  \nIntroduction  \nSQL Injection Example …  \n• But what if the user enters something like this  \n\n| Enter your account number | 9999’%20or%20’1’=‘1 |\n| --- | --- |\n| Your balance |  |\n\nres = select CBalance from Balances where Acct=‘9999’ or ‘1’=‘1’  \n• Since ‘1’=‘1’ is always true, the select statement will return all records  \n• res will contain, depending on the language  \n– every record  \n– the first record  \n– the last record  \nIntroduction  \nSQL Injection Example …  \n• If the code block is:  \nres = select CBalance from Balances where Acct=‘$acct’if res  \nPrintHTML (res)  \n• Then the application will print whatever is in res.  \n• The attacker will have valuable information for further attacks, such as issuing a transaction against the account number discovered  \nIntroduction  \nAn Example Program  \n• Command line form  \n– [http://www.cs.montana.edu/courses/csci476/code/sqli_ex1_mysql.py](http://www.cs.montana.edu/courses/csci476/code/sqli_ex1_mysql.py)  \n– [http://www.cs.montana.edu/courses/csci476/code/sqli_ex1_outputWeb form](http://www.cs.montana.edu/courses/csci476/code/sqli_ex1_outputWeb form)  \n– [http://www.cs.montana.edu/courses/csci476/code/sqli_form.html](http://www.cs.montana.edu/courses/csci476/code/sqli_form.html)  \n– [http://www.cs.montana.edu/courses/csci476/code/sqli_submit.php](http://www.cs.montana.edu/courses/csci476/code/sqli_submit.php)  \nIntroduction  \nAn Example Program  \n\u003C?php  \n\\# Simple PHP submit handler for mysqli $acct = $_GET['account'];  \n$con = mysqli_connect (\" [127.0.0.1](127.0.0.1) \", \"cs476\", \"passw\", \"cs476_ex1\"); if (mysqli_connect_errno ())  \n{  \necho \"Failed to connect to db: \" . mysqli_connect_error();  \nexit ();}  \n$result = $con->query ($","cbCairGhrqH79Goj","https://ap.wps.com/l/cbCairGhrqH79Goj","pdf",836339,44,"English","# What is an SQL Injection vulnerability\n## An example of SQL Injection\n## How the attacker views the situation\n# Introduction\n## SQL Injection Attack\n## SQL Injection Example DB\n## Results and injected conditions\n# An Example Program\n## Command line form\n## PHP submit handler","[{\"question\":\"What defect leads to an SQL Injection vulnerability?\",\"answer\":\"A software defect can create a security vulnerability, which is a weakness that enables certain attack types. One possible attack type is SQL Injection, so if the vulnerability allows those attacks, it is an SQL Injection vulnerability.\"},{\"question\":\"How does the example injection change the query results?\",\"answer\":\"The injected input alters the WHERE clause so that a condition such as '1'='1' becomes always true. That forces the query to return all (or a subset depending on the language) of the records instead of only the intended account.\"},{\"question\":\"What information can the attacker gain from the application output?\",\"answer\":\"If the application prints whatever is contained in the query result variable, the attacker can see data returned by the database. Those results can provide valuable details for further attacks, such as targeting an account discovered from the injection.\"}]","SQL Injection - An In-Depth Discussion - CSCI 476 | PDF",1791922743]