It is a type of attack used to destroy website by changing backend sql statements sql injection happens when a developer accepts user input that is directly placed into a sql statement and doesn’t properly filter out dangerous characters. This can allow an attacker to not only steal data from your database, but also modify and delete it.

SQL Injection

Bellow domo explain a type of sql injection and how we can prevent it

Creating a Data base with bellow table

created a database with the name “ users “:

Weh it submitted

$connect = mysql_connect(“localhost”,”root”,”") or die(“not connect”);
mysql_select_db(“samtest”) or die(“no database”);

$username=$_POST["username"];
$password=$_POST["password"];

if((isset($username)) && (isset($password)))
{
$sql=”SELECT * FROM useradmin where username=’$username’ AND password=’$password’”;
$result = mysql_query($sql);
$num_rows = mysql_num_rows($result);

if($num_rows!=0) {    echo” You Entered Correct Password”;  }
else {  echo” Wrong User name or Password”;}
}

We can enter bellow user name and password
User name : admin
Password : lazysam

Here I am going explain about sql injection

when user name and password entering time bellow sql code will work li

$sql=”SELECT * FROM useradmin where username=’admin’ AND password=’lazysam’”;

Statement will come true and in $num_rows we will get value so the if statement will take as true – will print – you entered correct password – if u enter wrong … num_rows will come zero and will get false

And plz try bellow word as user name and password

It displaying the username and password you entered is correct . means its working

SELECT * FROM useradmin WHERE username = ” OR ” = ” AND PASSWORD = ”OR ” = ”

See the statement come true – because the statement checking ‘’=’ null is equal to null how we can block such a sql injection

mysql_escape_string : use mysql real escape string

$sql=sprintf(“SELECT * FROM useradmin where username=’%s’ AND password=’%s’”,mysql_escape_string($username),mysql_escape_string($password));

This function will escape the unescaped_string, so that it is safe to place it in a mysql_query(). This function is deprecated.

This function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.

* This function has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged. ( Message which from php.net )

Please check bellow example after fixing error, use same user name and password ‘ OR ” = ‘ it will not allow you to enter , when we are doing applications we must check such a problems , else our site will get hacked or low security website .