{"id":1084,"date":"2023-04-18T08:45:54","date_gmt":"2023-04-18T08:45:54","guid":{"rendered":"https:\/\/www-dev.ubikasec.com\/en\/?p=1084"},"modified":"2023-12-11T13:33:12","modified_gmt":"2023-12-11T13:33:12","slug":"sql-injections-2","status":"publish","type":"post","link":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/","title":{"rendered":"SQL Injection"},"content":{"rendered":"<p>The <strong>SQL flaws<\/strong> are present when the server uses user input without filtering it to run one or more<strong> SQL queries<\/strong>.<\/p>\n<h2>What are the different types of SQL injections?<\/h2>\n<p>Different methods of exploiting <strong>SQL flaws<\/strong> exist and adapt depending on what the server allows.<\/p>\n<p>Among the most well-known:<\/p>\n<p><strong>&#8220;Classic&#8221; SQL flaw (with &#8216;OR 1=1 -):<\/strong><\/p>\n<p>This is the SQL flaw par excellence, especially present on authentication forms, it allows to connect to any user account.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The family of SQL (Structured Query Language) injections includes a large number of vulnerabilities that have in common the interaction with an SQL database.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1084","post","type-post","status-publish","format-standard","hentry","category-posts"],"acf":{"headings":[{"acf_fc_layout":"base","title_category_icon":766,"title_category":"Posts","title_category_color":"clr-pink","title":"SQL Injection","title_color":"clr-white","title_description":"The family of <strong>Structured Query Language (SQL)<\/strong>injections groups together a large number of vulnerabilities that have in common the interaction with a <strong>SQL database.<\/strong>","title_description_theme":"content-text-dark","title_buttons":null,"background":"bg-gradient-purple-blue-br","padding_top":"pt-xxlarge","padding_bottom":"pb-xxlarge","decoration":"deco-br","separator_top":false,"separator_top_color":"sep-white","separator_bottom":true,"separator_bottom_color":"sep-white","opt_breadcrumb":true,"opt_breadcrumb_theme":"breadcrumb-dark"}],"background_image":null,"modules":[{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1705],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"<h2>\"Union-based\" SQL query:<\/h2>\r\nIn SQL language, the UNION operator is used to merge the result of 2 queries, this adds the desired data to the data present in the first SQL query.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1086],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"<h2>\"Blind\" SQL flaw:<\/h2>\r\n\r\nPresent when the retrieved data is not displayed on the screen, the attacker will use a condition allowing him to pause and will rely on the response time of the system to know if his injection is successful, this technique is used in particular to \"brute force\" the data we want to recover.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1705],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"Many other methods of <strong>SQL injections<\/strong>, from the \"<strong>Error Based<\/strong>\" vulnerability that allows values to be displayed in an error message to the \"<strong>Stacked Query<\/strong>\" that gives the ability to perform any queries. It should be noted that databases<strong>NoSQL<\/strong> also have their vulnerabilities.\r\n\r\n<h2>Consequences of SQL injections<\/h2>\r\n\r\nSQL injections cause three big problems:\r\n\r\n<strong>Data recovery:<\/strong> Probably the most well-known problem related to SQL injections, with the ability to add custom queries, an attacker can recover any data present in a <strong>SQL<\/strong> database.\r\n\r\nIt is very common for databases to leak with users' personal information (name, email, address).\r\n\r\nThis implies that great care should be taken with sensitive data that might be stored online.\r\n\r\n<strong>Account theft:<\/strong> When an <strong>SQL injection<\/strong> is possible on a login form, it is very easy for an attacker to authenticate with an account that does not belong to him.\r\n\r\nIn addition to identity theft or data theft, it is the proper functioning of a web application that can be compromised if an administrator account is recovered.\r\n\r\n<strong>Data corruption:<\/strong> Most dangerous case, exploited with <strong>Stacked Querry<\/strong>.\r\n\r\nAn attacker who has the ability to perform any queries on a SQL database can very easily modify or delete data.\r\n\r\nIn addition to the corruption that can be problematic for important information, this can lead to the same problems mentioned above: An attacker who can change a password is an attacker who knows the password.\r\n\r\nMost websites store their content in a database, so if a hacker has access to it, he can practice defacing or publish fake news.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"<h2>How to do SQL injection<\/h2>\r\n<strong>Normal use of a search bar (PHP &amp; MYSQL)<\/strong>\r\nLet's take the example of an online tool sales site. On one of the pages of the web application is a search bar allowing to find an item with its name and price.\r\n\r\nLoris, the attacker will first perform a simple search to see the different models of lawn mower.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1088],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"split","mod_eyebrow":"","mod_eyebrow_color":"clr-purple","mod_title":"","mod_title_color":"clr-purple","mod_title_alignment":"align-left","mod_wysiwyg":"","mod_wysiwyg_theme":"content-text-light","mod_col_left":[{"acf_fc_layout":"mod_item_text","mod_item_text_el":"When he clicks the button the server will retrieve his input and insert it into a <strong>SQL query<\/strong>.\r\n\r\nThe server will then send this <strong>SQL command<\/strong> to the database which will execute it as code.\r\n\r\nThe latter will then fetch from the \"items\" table all the name and price of the items containing \"<strong>tondeuse<\/strong>\" in their name and with a stock greater than zero.\r\n\r\nThe server will retrieve this information and can then display it on Loris' screen.\r\n\r\n<strong>2. Testing an SQL injection<\/strong>\r\nLoris sees that his search has been added to the url in the form \"?name=tondeuse.\"\r\n\r\nHe then decides to test if this parameter allows to enter <strong>SQL code<\/strong>.\r\n\r\nHe adds a \" <strong>'<\/strong>\" which allows to open and close a string in <strong>SQL<\/strong>\r\n\r\nThe database will then receive the following <strong>SQL command<\/strong>:\r\n\r\nThis query is invalid, as the second \"<strong>%<\/strong>\" ending up outside the string is considered a forbidden character","item_options":{"item_option_paragraph_theme":"content-text-light"}},{"acf_fc_layout":"mod_item_text","mod_item_text_el":"An error is then returned, \"<strong>MySQL error: Invalid Syntax<\/strong>\"\r\n\r\nLoris now knows that a <strong>MySQL<\/strong> database is used.\r\n\r\nIn order to avoid this error Loris adds a MySQL comment to his query, this will allow him to remove the rest of the command thanks to the syntax \" <strong>'-<\/strong>\" ","item_options":{"item_option_paragraph_theme":"content-text-light"}},{"acf_fc_layout":"mod_item_text","mod_item_text_el":"This time the database accepts the query and will return all items, with the percentage acting as a <strong>wildcard<\/strong>, including those no longer in stock, with the condition removed","item_options":{"item_option_paragraph_theme":"content-text-light"}}],"mod_col_right":[{"acf_fc_layout":"mod_item_text","mod_item_text_el":"","item_options":{"item_option_paragraph_theme":"content-text-light"}},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1090},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1091},{"acf_fc_layout":"mod_item_title","mod_item_title_el":"","item_options":{"item_option_alignment":"align-left","item_option_color":"clr-black"}},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1092},{"acf_fc_layout":"mod_item_title","mod_item_title_el":"","item_options":{"item_option_alignment":"align-left","item_option_color":"clr-black"}},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1093},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1094},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1095}],"columns_theme":"col-transparent","background_image":"","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","left_valign":"force-v-align-top","right_valign":"force-v-align-top","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-purple","mod_title_alignment":"align-left","images":[1096],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"split","mod_eyebrow":"","mod_eyebrow_color":"clr-purple","mod_title":"","mod_title_color":"clr-purple","mod_title_alignment":"align-left","mod_wysiwyg":"Loris only has to add his own requests to exploit the vulnerability.","mod_wysiwyg_theme":"content-text-light","mod_col_left":[{"acf_fc_layout":"mod_item_text","mod_item_text_el":"<strong>3. SQL Injection Example<\/strong>.\r\n\r\nNow that Loris has a valid query, the <strong>SQL injection<\/strong> attack can begin\r\n\r\nHis goal is going to be to retrieve the user passwords stored in the database\r\n\r\nFirst of all, it needs to invalidate the current query so as not to retrieve the information on the items, for this, a simple \"<strong>AND 1=2 -<\/strong>\" will suffice.\r\n\r\nThe query will then try to retrieve the items if the condition <strong>1=2<\/strong> is validated, therefore, there will be no more results.\r\n\r\nLoris will then use the <strong>UNION<\/strong> operator which allows to merge queries and add a <strong>SELECT<\/strong> allowing him to retrieve the name of the different <strong>tables.<\/strong>\r\n\r\nWith a few more SQL queries on different tables, Loris will discover that Paul is the site administrator, so he will retrieve his password.\r\n\r\nSo the password is cb28e00ef51374b841fb5c189b2b91c9.\r\n\r\nObviously passwords are never stored in clear text and this format seems to be that of an MD5 hash\r\n\r\nThe MD5 is an algorithm used to encrypt a text, you can't reverse it but, some sites (https:\/\/md5decrypt.net\/ for example) store a lot of text match - <strong>hash MD5<\/strong>.\r\n\r\nLoris is lucky and finds the password associated with the hash: <strong>password123456<\/strong>\r\n\r\nLoris only has to authenticate with the pair <strong>Paul \/ password123456<\/strong> to get access to an administrator account.\r\n\r\nIn our example, the <strong>SQL injection<\/strong> attack was performed manually.\r\n\r\nHowever, today there are tools such as<strong>SQLMap<\/strong> that make it easy to detect these attacks with pre-made scripts.\r\n","item_options":{"item_option_paragraph_theme":"content-text-light"}}],"mod_col_right":[{"acf_fc_layout":"mod_item_image","mod_item_image_el":1098},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1099},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1101},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1100},{"acf_fc_layout":"mod_item_image","mod_item_image_el":""},{"acf_fc_layout":"mod_item_image","mod_item_image_el":1102}],"columns_theme":"col-transparent","background_image":"","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","left_valign":"force-v-align-top","right_valign":"force-v-align-top","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"<strong>3. Example of SQL Injection<\/strong><h2>OWASP recommendation<\/h2>\r\n\r\nThe Open Web Application Security Project (OWASP) provides a guide to avoid SQL injections, here we will summarize the different options available to a developer.\r\n\r\n<strong>Prepared queries<\/strong>which consist of writing <strong>SQL queries<\/strong> and adding the parameters to them later. This method allows you to insert parameters while avoiding escape character injection.\r\nU<strong>using a \"whitelist\" (a list of allowed values)<\/strong> allows you to restrict the user's scope of action and accept only upstream parameterized values\r\n<strong>Escape user input<\/strong> remain an effective way to avoid any escape characters\r\n\r\n<h2>UBIKA Cloud protector vs SQL injections<\/h2>\r\nTo avoid different types of <a href=\"https:\/\/www.ubikasec.com\/en\/videos\/sql-injections\/\">SQL injections<\/a>, <strong>UBIKA Cloud Protector<\/strong> provides several tools:\r\n\r\nThe \"<strong>Blacklisting<\/strong>\" used on all protection levels:\r\nIf <strong>UBIKA Cloud Protector<\/strong> detects a <strong>pattern<\/strong> typically used to exploit a <strong>SQL flaw<\/strong>, the query will be immediately <strong>blocked<\/strong> and <strong>redirected<\/strong>.\r\n\r\n<strong>\"Scoring List\"<\/strong>active on Advanced and High levels of protection:\r\n\r\n<strong>UBIKA Cloud Protector<\/strong> will analyze the request and increment a score as <strong>malicious patterns<\/strong> are encountered. At the end of the analysis, if the score is above the allowed limit the request is <strong>blocked<\/strong> and <strong>redirected<\/strong>. This method has the advantage of being much finer and avoiding<strong>false positives.<\/strong>\r\n\r\nNow that Loris has a valid query, the <strong>SQL injection<\/strong> attack can begin\r\n\r\nHis objective is going to be to retrieve the users' passwords stored in the database\r\n\r\nFirst of all, it needs to invalidate the current query so as not to retrieve the information on the items, for this, a simple \"<strong>AND 1=2 -<\/strong>\" will suffice.\r\n\r\nThe query will then try to retrieve the items if the condition <strong>1=2<\/strong> is validated, therefore, there will be no more results.\r\n\r\nLoris will then use the <strong>UNION<\/strong> operator which allows to merge queries and add a <strong>SELECT<\/strong> allowing him to retrieve the name of the different <strong>tables.<\/strong>\r\n\r\nWith a few more SQL queries on different tables, Loris will discover that Paul is the site administrator, so he will retrieve his password.\r\n\r\nSo the password is cb28e00ef51374b841fb5c189b2b91c9.\r\n\r\nObviously passwords are never stored in clear text and this format seems to be that of an MD5 hash\r\n\r\nThe MD5 is an algorithm used to encrypt a text, you can't reverse it but, some sites (https:\/\/md5decrypt.net\/ for example) store a lot of text match - <strong>hash MD5<\/strong>.\r\n\r\nLoris is lucky and finds the password associated with the hash: <strong>password123456<\/strong>\r\n\r\nLoris only has to authenticate with the pair <strong>Paul \/ password123456<\/strong> to get access to an administrator account.\r\n\r\nIn our example, the <strong>SQL injection<\/strong> attack was performed manually.\r\n\r\nHowever, today there are tools such as<strong>SQLMap<\/strong> that make it easy to detect these attacks with pre-made scripts.\r\n","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1103],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1104],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""}],"dl_form":"","dl_form_title":"","dl_gated":false,"dl_asset":""},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SQL injections: principle &amp; example<\/title>\n<meta name=\"description\" content=\"SQL injections is a common attack technique used to exploit security flaws in web applications, find out more about SQL injections.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SQL injections: principle &amp; example\" \/>\n<meta property=\"og:description\" content=\"SQL injections is a common attack technique used to exploit security flaws in web applications, find out more about SQL injections.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/\" \/>\n<meta property=\"og:site_name\" content=\"UBIKA\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-18T08:45:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-12-11T13:33:12+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"SQL Injection\",\"datePublished\":\"2023-04-18T08:45:54+00:00\",\"dateModified\":\"2023-12-11T13:33:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/\"},\"wordCount\":76,\"articleSection\":[\"Posts\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/\",\"url\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/\",\"name\":\"SQL injections: principle & example\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/#website\"},\"datePublished\":\"2023-04-18T08:45:54+00:00\",\"dateModified\":\"2023-12-11T13:33:12+00:00\",\"author\":{\"@id\":\"\"},\"description\":\"SQL injections is a common attack technique used to exploit security flaws in web applications, find out more about SQL injections.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/posts\\\/sql-injections-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SQL Injection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/\",\"name\":\"UBIKA\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"\",\"url\":\"https:\\\/\\\/www.ubikasec.com\\\/en\\\/author\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SQL injections: principle & example","description":"SQL injections is a common attack technique used to exploit security flaws in web applications, find out more about SQL injections.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/","og_locale":"en_US","og_type":"article","og_title":"SQL injections: principle & example","og_description":"SQL injections is a common attack technique used to exploit security flaws in web applications, find out more about SQL injections.","og_url":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/","og_site_name":"UBIKA","article_published_time":"2023-04-18T08:45:54+00:00","article_modified_time":"2023-12-11T13:33:12+00:00","twitter_card":"summary_large_image","twitter_misc":{"Written by":"","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/#article","isPartOf":{"@id":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/"},"author":{"name":"","@id":""},"headline":"SQL Injection","datePublished":"2023-04-18T08:45:54+00:00","dateModified":"2023-12-11T13:33:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/"},"wordCount":76,"articleSection":["Posts"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/","url":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/","name":"SQL injections: principle & example","isPartOf":{"@id":"https:\/\/www.ubikasec.com\/en\/#website"},"datePublished":"2023-04-18T08:45:54+00:00","dateModified":"2023-12-11T13:33:12+00:00","author":{"@id":""},"description":"SQL injections is a common attack technique used to exploit security flaws in web applications, find out more about SQL injections.","breadcrumb":{"@id":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.ubikasec.com\/en\/posts\/sql-injections-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ubikasec.com\/en\/"},{"@type":"ListItem","position":2,"name":"SQL Injection"}]},{"@type":"WebSite","@id":"https:\/\/www.ubikasec.com\/en\/#website","url":"https:\/\/www.ubikasec.com\/en\/","name":"UBIKA","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ubikasec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"","url":"https:\/\/www.ubikasec.com\/en\/author\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/posts\/1084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/comments?post=1084"}],"version-history":[{"count":5,"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/posts\/1084\/revisions"}],"predecessor-version":[{"id":1996,"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/posts\/1084\/revisions\/1996"}],"wp:attachment":[{"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/media?parent=1084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/categories?post=1084"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ubikasec.com\/en\/wp-json\/wp\/v2\/tags?post=1084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}