SQL injection in Cybersecurity - Step-by-Step Execution

Concept Flow - SQL injection

User inputs data

↓

Input sent to SQL query

↓

SQL query constructed

↓

Database executes query

↓

If input contains malicious SQL code?

Yes→Malicious SQL runs

↓

Data leaked or altered

↓

Query runs normally

↓

Security breach

↓

Expected data returned

↓

User sees results

User input is added to a SQL query. If input contains harmful SQL code, the database runs it, causing data leaks or changes.

Execution Sample

Cybersecurity

user_input = "' OR '1'='1" 
query = "SELECT * FROM users WHERE name = '" + user_input + "'"
execute(query)

Shows how a malicious input changes a SQL query to always return data.

Analysis Table

Step	User Input	SQL Query Constructed	Database Action	Result
1	' OR '1'='1	SELECT * FROM users WHERE name = '' OR '1'='1'	Execute query	Returns all users because condition is always true
2	Alice	SELECT * FROM users WHERE name = 'Alice'	Execute query	Returns data for user Alice
3	'; DROP TABLE users; --	SELECT * FROM users WHERE name = ''; DROP TABLE users; --	Execute query	Deletes users table (dangerous)
4	Bob	SELECT * FROM users WHERE name = 'Bob'	Execute query	Returns data for user Bob
5		SELECT * FROM users WHERE name = ''	Execute query	Returns no users
6	END			Stop execution

💡 Execution stops after processing all inputs or when malicious code causes failure.

State Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
user_input	None	' OR '1'='1	Alice	'; DROP TABLE users; --	Bob		END
query	None	SELECT * FROM users WHERE name = '' OR '1'='1'	SELECT * FROM users WHERE name = 'Alice'	SELECT * FROM users WHERE name = ''; DROP TABLE users; --	SELECT * FROM users WHERE name = 'Bob'	SELECT * FROM users WHERE name = ''	None

Key Insights - 3 Insights

Why does the query return all users when input is "' OR '1'='1"?

Because the input changes the WHERE clause to always be true ('1'='1'), so the database returns all rows (see execution_table step 1).

How can malicious input delete data?

If input includes SQL commands like "; DROP TABLE users; --", the database runs those commands, deleting tables (see execution_table step 3).

Why does an empty input return no users?

Because the query looks for name = '', which matches no users, so no data is returned (see execution_table step 5).

Visual Quiz - 3 Questions

Look at the execution_table at step 1. What does the query return?

A Only user '1'

B No users

C All users

D An error

💡 Hint

Check the 'Result' column in execution_table row 1.

At which step does the database get a command to delete data?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look for DROP TABLE command in 'SQL Query Constructed' column.

If user_input was always safe text like 'Charlie', how would the query behave?

A Return no users

B Return data only for Charlie

C Return all users

D Delete tables

💡 Hint

See variable_tracker for safe inputs and their queries.

Concept Snapshot

SQL injection happens when user input is added directly to SQL queries.
Malicious input can change query meaning, causing data leaks or damage.
Always validate or use safe methods to handle user input.
Example: input "' OR '1'='1" makes query return all data.
Prevent by using prepared statements or parameterized queries.

Full Transcript

SQL injection is a security problem where bad input changes a database query. When a user types something, it is added to a SQL command. If the input includes special SQL code, the database runs it. This can cause data leaks or delete data. For example, input like "' OR '1'='1" makes the query always true, returning all data. Another input can delete tables. Safe coding means never adding user input directly to queries. Use prepared statements to keep data safe.

Practice

1. What is SQL injection in cybersecurity?

easy

A. A method to speed up database queries

B. A way to backup database data securely

C. A technique to trick databases into running harmful commands

D. A process to encrypt database connections

Solution

1. Step 1: Understand SQL injection meaning

   SQL injection is a cyberattack where harmful commands are inserted into database queries.

2. Step 2: Identify correct description

   Only the technique to trick databases into running harmful commands describes this attack method accurately.

3. Final Answer:

   A technique to trick databases into running harmful commands -> Option C

4. Quick Check:

   SQL injection = harmful commands trick [OK]

Hint: SQL injection tricks databases with harmful commands [OK]

Common Mistakes:

• Confusing SQL injection with database backup
• Thinking SQL injection speeds up queries
• Mixing SQL injection with encryption

2. Which of the following is a correct way to prevent SQL injection?

easy

A. Using parameterized queries or prepared statements

B. Directly inserting user input into SQL queries without checks

C. Ignoring user input validation

D. Allowing all user inputs without restrictions

Solution

1. Step 1: Review prevention methods

   Safe coding practices include using parameterized queries to separate code from data.

2. Step 2: Identify correct prevention

   Using parameterized queries or prepared statements correctly states using parameterized queries or prepared statements to prevent injection.

3. Final Answer:

   Using parameterized queries or prepared statements -> Option A

4. Quick Check:

   Safe queries = parameterized/prepared [OK]

Hint: Use parameterized queries to stop SQL injection [OK]

Common Mistakes:

• Directly inserting unchecked user input
• Skipping input validation
• Assuming all inputs are safe

3. Consider this SQL query in a login system:
SELECT * FROM users WHERE username = 'admin' AND password = 'password123';
What happens if an attacker inputs ' OR '1'='1 as the password?

medium

A. The query returns no results

B. The query causes a syntax error

C. The query only returns the admin user

D. The query returns all users, bypassing password check

Solution

1. Step 1: Analyze injected input effect

   The input ' OR '1'='1' changes the WHERE clause to always true, bypassing password check.

2. Step 2: Understand query result

   Because '1'='1' is always true, the query returns all users, ignoring password.

3. Final Answer:

   The query returns all users, bypassing password check -> Option D

4. Quick Check:

   Injection ' OR '1'='1' = bypass password [OK]

Hint: Injection ' OR '1'='1' bypasses password check [OK]

Common Mistakes:

• Thinking it causes syntax error
• Assuming it returns no results
• Believing it returns only admin user

4. A developer wrote this SQL query:
query = "SELECT * FROM users WHERE name = '" + user_input + "';"
What is the main problem with this code?

medium

A. It concatenates user input directly into the query, risking SQL injection

B. It prevents SQL injection by validating input

C. It properly escapes user input

D. It uses parameterized queries correctly

Solution

1. Step 1: Examine query construction

   The code builds the SQL query by adding user input directly into the string.

2. Step 2: Identify security risk

   This direct concatenation allows attackers to inject malicious SQL commands.

3. Final Answer:

   It concatenates user input directly into the query, risking SQL injection -> Option A

4. Quick Check:

   Direct concatenation = SQL injection risk [OK]

Hint: Never concatenate user input directly into SQL queries [OK]

Common Mistakes:

• Assuming concatenation is safe
• Thinking input is automatically escaped
• Believing this code validates input

5. You have a web form that accepts a username to search a database. Which approach best protects against SQL injection when building the query?

hard

A. Use string concatenation with manual input cleaning

B. Use parameterized queries with placeholders for user input

C. Allow all input and filter results after query

D. Disable database error messages only

Solution

1. Step 1: Evaluate protection methods

   Parameterized queries separate code from data, preventing injection regardless of input.

2. Step 2: Compare options

   Use parameterized queries with placeholders for user input uses placeholders safely; other options either rely on unsafe cleaning or do not prevent injection.

3. Final Answer:

   Use parameterized queries with placeholders for user input -> Option B

4. Quick Check:

   Best protection = parameterized queries [OK]

Hint: Always use parameterized queries to prevent injection [OK]

Common Mistakes:

• Relying on manual input cleaning
• Filtering results after query is unsafe
• Only hiding error messages does not protect