Description

SQL injection is a technique for exploitingweb applications that use client-supplied data in SQL querieswithout stripping potentially harmful characters first. Despitebeing remarkably simple to protect against, there is an astonishingnumber of production systems connected to the Internet that arevulnerable to this type of attack. The objective of this paper isto educate the professional security community on the techniquesthat can be used to take advantage of a web application that isvulnerable to SQL injection, and to make clear the correctmechanisms that should be put in place to protect against SQLinjection and input validation problems in general.