The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

can cross-reference with a fully transparent working version of the database in

question. 

If this is not feasible, a good alternative is to find a suitable interactive online

environment that you can experiment on, such as the interactive tutorials at

SQLzoo.net

.

Exploiting a Basic Vulnerability

Consider a web application deployed by a book retailer that enables users to

search for products based on author, title, publisher, and so on. The entire book

catalog is held within a database, and the application uses SQL queries to

retrieve details of different books based on the search terms supplied by users. 

When a user searches for all books published by Wiley, the application per-

forms the following query:

SELECT author,title,year FROM books WHERE publisher = ‘Wiley’

This query causes the database to check every row within the books table,

extract each of the records where the 

publisher

column has the value 

Wiley

,

and return the set of all these records. This record set is then processed by the

application and presented to the user within an HTML page.

In this query, the words to the left of the equals sign comprise SQL key-

words and the names of tables and columns within the database. All of this

portion of the query was constructed by the programmer at the time the appli-

cation was created. The expression 

Wiley

, of course, is supplied by the user,

and its significance is as an item of data. String data in SQL queries must be

encapsulated within single quotation marks, to separate it from the rest of the

query.