SQL injection via network in Computer Networks - Step-by-Step Execution

Concept Flow - SQL injection via network

User sends input over network

↓

Server receives input

↓

Input used in SQL query without checks

↓

Database executes query

↓

Malicious SQL runs, data exposed or changed

↓

Server sends response back to user

This flow shows how a user sends data over a network that the server uses directly in a database query, allowing harmful SQL commands to run.

Execution Sample

Computer Networks

User input: ' OR '1'='1
Server query: SELECT * FROM users WHERE name = '' OR '1'='1';

A user sends a crafted input that changes the SQL query logic to always be true, exposing all user data.

Analysis Table

Step	Network Input	SQL Query Formed	Query Result	Server Response
1	' OR '1'='1	SELECT * FROM users WHERE name = '' OR '1'='1';	All user records returned	Server sends all user data
2	Normal input: 'Alice'	SELECT * FROM users WHERE name = 'Alice';	Only Alice's record returned	Server sends Alice's data
3	Input ends	No more queries	No action	Connection closed

💡 Execution stops after input ends and server finishes responding.

State Tracker

Variable	Start	After Step 1	After Step 2	Final
Network Input	None	' OR '1'='1	Alice	None
SQL Query	None	SELECT * FROM users WHERE name = '' OR '1'='1';	SELECT * FROM users WHERE name = 'Alice';	None
Query Result	None	All user records	Alice's record	None
Server Response	None	All user data sent	Alice's data sent	Connection closed

Key Insights - 3 Insights

Why does the input ' OR '1'='1 cause all user data to be returned?

Because the input changes the SQL WHERE clause to always be true ('1'='1'), so the database returns all records instead of filtering by name. See execution_table step 1.

Why is normal input like 'Alice' safe compared to the malicious input?

Normal input does not change the logic of the SQL query; it searches for a specific name only. The malicious input adds extra conditions that bypass filtering. See execution_table step 2.

What stops the server from running more queries after the input ends?

The server stops processing when no more input is received and the connection closes, ending the session. See execution_table step 3.

Visual Quiz - 3 Questions

Look at the execution_table at step 1, what does the SQL query do?

A Returns all user records

B Returns no records

C Returns only one user record

D Causes an error

💡 Hint

Check the 'Query Result' column at step 1 in the execution_table.

At which step does the server send only one user's data?

A Step 1

B Step 2

C Step 3

D Never

💡 Hint

Look at the 'Server Response' column in the execution_table.

If the server checked inputs before using them in SQL, how would step 1 change?

A The server would crash

B The query would still return all records

C The malicious input would be blocked or escaped

D The input would be ignored

💡 Hint

Refer to the concept_flow where input is used without checks.

Concept Snapshot

SQL injection via network:
- User sends input over network to server
- Server uses input directly in SQL query
- Malicious input can change query logic
- This can expose or modify data
- Always validate or escape inputs before use

Full Transcript

This visual execution shows how SQL injection happens over a network. A user sends input that the server uses directly in a database query. If the input includes special SQL code like ' OR '1'='1, it changes the query to return all data instead of filtering. The server then sends all user data back. Normal inputs like 'Alice' only return that user's data. The process stops when no more input is sent and the connection closes. To prevent this, servers must check or escape inputs before using them in queries.