SQL injection via network in Computer Networks - Step-by-Step Execution

Concept Flow - SQL injection via network

User sends input over network

↓

Server receives input

↓

Input used in SQL query without checks

↓

Database executes query

↓

Malicious SQL runs, data exposed or changed

↓

Server sends response back to user

This flow shows how a user sends data over a network that the server uses directly in a database query, allowing harmful SQL commands to run.

Execution Sample

Computer Networks

User input: ' OR '1'='1
Server query: SELECT * FROM users WHERE name = '' OR '1'='1';

A user sends a crafted input that changes the SQL query logic to always be true, exposing all user data.

Analysis Table

Step	Network Input	SQL Query Formed	Query Result	Server Response
1	' OR '1'='1	SELECT * FROM users WHERE name = '' OR '1'='1';	All user records returned	Server sends all user data
2	Normal input: 'Alice'	SELECT * FROM users WHERE name = 'Alice';	Only Alice's record returned	Server sends Alice's data
3	Input ends	No more queries	No action	Connection closed

💡 Execution stops after input ends and server finishes responding.

State Tracker

Variable	Start	After Step 1	After Step 2	Final
Network Input	None	' OR '1'='1	Alice	None
SQL Query	None	SELECT * FROM users WHERE name = '' OR '1'='1';	SELECT * FROM users WHERE name = 'Alice';	None
Query Result	None	All user records	Alice's record	None
Server Response	None	All user data sent	Alice's data sent	Connection closed

Key Insights - 3 Insights

Why does the input ' OR '1'='1 cause all user data to be returned?

Because the input changes the SQL WHERE clause to always be true ('1'='1'), so the database returns all records instead of filtering by name. See execution_table step 1.

Why is normal input like 'Alice' safe compared to the malicious input?

Normal input does not change the logic of the SQL query; it searches for a specific name only. The malicious input adds extra conditions that bypass filtering. See execution_table step 2.

What stops the server from running more queries after the input ends?

The server stops processing when no more input is received and the connection closes, ending the session. See execution_table step 3.

Visual Quiz - 3 Questions

Look at the execution_table at step 1, what does the SQL query do?

A Returns all user records

B Returns no records

C Returns only one user record

D Causes an error

💡 Hint

Check the 'Query Result' column at step 1 in the execution_table.

At which step does the server send only one user's data?

A Step 1

B Step 2

C Step 3

D Never

💡 Hint

Look at the 'Server Response' column in the execution_table.

If the server checked inputs before using them in SQL, how would step 1 change?

A The server would crash

B The query would still return all records

C The malicious input would be blocked or escaped

D The input would be ignored

💡 Hint

Refer to the concept_flow where input is used without checks.

Concept Snapshot

SQL injection via network:
- User sends input over network to server
- Server uses input directly in SQL query
- Malicious input can change query logic
- This can expose or modify data
- Always validate or escape inputs before use

Full Transcript

This visual execution shows how SQL injection happens over a network. A user sends input that the server uses directly in a database query. If the input includes special SQL code like ' OR '1'='1, it changes the query to return all data instead of filtering. The server then sends all user data back. Normal inputs like 'Alice' only return that user's data. The process stops when no more input is sent and the connection closes. To prevent this, servers must check or escape inputs before using them in queries.

Practice

1. What is SQL injection via network in simple terms?

easy

A. A way to backup database data remotely

B. A method to speed up database queries over the network

C. An attack where harmful commands are sent to a database through a network connection

D. A network protocol for secure database communication

Solution

1. Step 1: Understand the meaning of SQL injection

   SQL injection means sending harmful commands to a database to manipulate or steal data.

2. Step 2: Connect SQL injection with network

   When these harmful commands are sent through a network connection, it is called SQL injection via network.

3. Final Answer:

   An attack where harmful commands are sent to a database through a network connection -> Option C

4. Quick Check:

   SQL injection via network = harmful commands sent over network [OK]

Hint: Think: harmful commands sent through network to database [OK]

Common Mistakes:

• Confusing SQL injection with normal database queries
• Thinking it is a backup or speed method
• Mixing it up with network security protocols

2. Which of the following is a correct way to prevent SQL injection via network?

easy

A. Use input validation and parameterized queries

B. Send raw SQL commands directly over the network

C. Disable network connections to the database

D. Allow all user inputs without checks

Solution

1. Step 1: Identify safe practices against SQL injection

   Input validation checks user data, and parameterized queries separate data from commands, preventing injection.

2. Step 2: Evaluate other options

   Sending raw commands or allowing unchecked inputs increases risk; disabling network is impractical.

3. Final Answer:

   Use input validation and parameterized queries -> Option A

4. Quick Check:

   Safe coding = input validation + parameterized queries [OK]

Hint: Prevent injection by validating inputs and using safe queries [OK]

Common Mistakes:

• Thinking disabling network is practical
• Believing raw SQL commands are safe
• Ignoring input validation importance

3. Consider this SQL query sent over a network: SELECT * FROM users WHERE username = '' OR '1'='1';. What is the likely result?

medium

A. Causes the database to crash

B. Returns no users because of syntax error

C. Returns only users with empty username

D. Returns all users because the condition is always true

Solution

1. Step 1: Analyze the SQL condition

   The condition username = '' OR '1'='1' means either username is empty or '1' equals '1'. Since '1'='1' is always true, the whole condition is true for all rows.

2. Step 2: Understand query effect

   Because the WHERE clause is always true, the query returns all users from the table.

3. Final Answer:

   Returns all users because the condition is always true -> Option D

4. Quick Check:

   Always true condition returns all rows [OK]

Hint: Look for always true conditions like '1'='1' [OK]

Common Mistakes:

• Assuming syntax error due to quotes
• Thinking it returns no rows
• Believing it crashes the database

4. A developer wrote this query to get user info: "SELECT * FROM users WHERE id = " + user_input; sent over network. What is the main problem?

medium

A. It concatenates user input directly, risking SQL injection

B. It uses prepared statements safely

C. It uses parameterized queries correctly

D. It encrypts user input before sending

Solution

1. Step 1: Examine how user input is used

   The query concatenates user input directly into the SQL string, which can allow attackers to insert harmful commands.

2. Step 2: Identify risk of SQL injection

   Direct concatenation without validation or parameterization is a common cause of SQL injection vulnerabilities.

3. Final Answer:

   It concatenates user input directly, risking SQL injection -> Option A

4. Quick Check:

   Direct input concatenation = injection risk [OK]

Hint: Avoid direct string concatenation with user input [OK]

Common Mistakes:

• Thinking concatenation is safe
• Confusing with parameterized queries
• Assuming encryption is done automatically

5. You receive a network log showing this suspicious query: SELECT * FROM accounts WHERE user = 'admin'--' AND password = 'anything'; What does the -- do in this SQL injection attempt?

hard

A. Encrypts the password part of the query

B. Comments out the rest of the query, bypassing password check

C. Ends the SQL statement safely

D. Causes a syntax error and stops execution

Solution

1. Step 1: Understand the role of -- in SQL

   The -- sequence starts a comment in SQL, ignoring everything after it on the same line.

2. Step 2: Analyze the effect on the query

   By commenting out the password check, the attacker bypasses authentication, gaining access as 'admin'.

3. Final Answer:

   Comments out the rest of the query, bypassing password check -> Option B

4. Quick Check:

   -- = comment to skip code [OK]

Hint: Remember -- starts a comment in SQL [OK]

Common Mistakes:

• Thinking -- encrypts or ends query safely
• Assuming it causes syntax error
• Not realizing it bypasses checks