SQL Injection and How It Works

This lesson explains SQL injection, a common and dangerous attack technique covered in OCR J277 Section 1.4. SQL injection targets databases through web applications and can result in data theft, data modification, or complete system compromise.

---

What Is SQL?

SQL (Structured Query Language) is the standard language used to communicate with and manage relational databases. Web applications commonly use SQL to:

• Retrieve user data (e.g. usernames, passwords)
• Insert new records (e.g. registering a new user)
• Update existing records (e.g. changing a password)
• Delete records

For example, when you log in to a website, the application might run an SQL query like:

SELECT * FROM users WHERE username = 'john' AND password = 'secret123'

If this query returns a matching record, the user is granted access.

---

What Is SQL Injection?

SQL injection is an attack where malicious SQL code is inserted into input fields (such as login forms or search boxes) that are then passed to a database query. If the application does not properly validate or sanitise user input, the injected SQL is executed by the database server.

How SQL injection works — step by step:

1. A website has a login form with username and password fields.
2. The application builds an SQL query using the input directly:

   SELECT * FROM users WHERE username = '[input]' AND password = '[input]'
   

3. Instead of entering a genuine username, the attacker enters:

   ' OR 1=1 --
   

4. The resulting SQL query becomes:

   SELECT * FROM users WHERE username = '' OR 1=1 --' AND password = ''
   

5. OR 1=1 is always true, so the query returns all users. The -- is an SQL comment that ignores the rest of the query.
6. The attacker is logged in without a valid password.

OCR Exam Tip: You do not need to write SQL code in the exam, but you must be able to explain what SQL injection is and how it works. Describe it as: "entering malicious SQL code into an input field to manipulate the database query."

---

What Can SQL Injection Do?