Preventing SQL Injection Attacks and Other Security Breaches

Nathan — Wed, 27 Apr 2011 14:55:04 +0000

Last week, hundreds of thousands of URLs were hit by a large-scale SQL injection attack that seemed to target sites at random. The attack works when HTML code is inserted into the database, which renders on the site’s pages and executes JavaScript code located on a remote server. This code then redirects the user to a fake anti-virus site that then attempts to further compromise the user’s browser. The methodology of this assault actually is much closer in behavior to a cross-site scripting (XSS) attack, although it has been widely reported as a SQL injection attack. Another notable element is that the sites affected used a range of the most common server technologies (ASP, PHP, ColdFusion, JSP), so the exploit was not limited to a single coding language or server technology.

The wide scope of this attack begs the question of how developers and webmasters can prevent their own sites from falling victim to similar malicious strategies.

SQL injection attacks work by exploiting poorly-written database code to insert unwanted SQL into database queries in order to view, modify, or gain access to the database.

Cross-site scripting (XSS) attacks work a little differently because they typically don’t have to alter the SQL queries themselves. These attacks simply insert a snippet of JavaScript code into the text fields of the database that are then displayed somewhere on the website. Whenever pages with this malicious script are visited, the code executes and redirects the user. The goal of XSS attacks is to run some remote code or redirect the user to a spyware-infested website.

In both SQL injection attacks and XSS attacks, your susceptibility can be greatly lessened by proactively controlling any form of user-entered information and “sanitizing” your input. For example, by not allowing HTML code to be entered, filtering out certain dangerous characters, and HTML encoding text before inserting it into the database, you can eliminate many of the possible means of attack.

One of the simplest and most effective measures you can take is to make use of database parameters whenever making queries as they have built-in features to filter input and make variables database-safe. Almost all modern languages support parameterized queries, they eliminate much of the potential for error, and they are especially useful for preventing SQL injection attacks.

While it is important to filter input to prevent SQL injection attacks, it can also be beneficial to filter text that is being displayed to prevent XSS hacks. This can entail HTML encoding output or filtering for specific elements, such as hyperlinks or

Blueprint: The Blog from Medium Blue » Uncategorized

Preventing SQL Injection Attacks and Other Security Breaches