SQL Injection Attack

Fortunately or unfortunately found a top security bug in one of our applications. It turns out to be the most famous "SQL Injection attack" bug. It has been sitting there for a while in our PHP applications.

There was one of the links which was supposedly under a login page which took URL parameters. The URL parameter could be modified to conduct the SQL Injection attack by following steps:

Step 1 Lets assume the URL is - https://noname.com/result/trick.php?PARAM1=777
Step 2 In the actual PHP code, there was inline SQL query that is getting executed to retrieve some values from the database.
Step 3 If the code is not secure enough, we can trick the code to execute other statements in the database:
https://noname.com/result/trick.php?PARAM1=777; delete from table1;--

This was the last thing I did before reporting the issue to the developer and also gaining some praise in this process.

There were other things I could do:

1) Enter the wrong parameter or SQL statement --> Database error was shown by the PHP compiler. The error also spewed out the wrong SQL statement giving information about the database tables.


I am sure there are many ways to prevent the above attacks but I have listed a few -

• Secure your code by taking the URL parameter in single quotes while preparing the SQL statement. (where column1 = '$URLparameter'). The PHP compiler will escape any bad input entered in the URL with a single quote (').
  
• Change the PHP settings to hide database errors
• Encrypt your URL parameters (use any algorithm)
• Best way of prevention is to use Stored Procedures instead of inline SQL.