Instructor: As you've seen so far, 2 2
SQL injections are very dangerous. 3 3
Also, they're very easy to (mumbles) and very easy to find. 4 4
You'll find them everywhere in some really famous websites. 5 5
People try to prevent these vulnerabilities using filters. 6 6
Filters can make it look like there is no exploits, 7 7
but if you actually try harder by using encodings, 8 8
different types of encoding, or using a proxy, 9 9
then you'll be able to bypass most of these filters. 10 10
Some programmers use a blacklist. 11 11
For example, they prevent the use of union, 12 12
they prevent the use of insert and stuff like that. 13 13
Again, it's not 100% secure. 14 14
It can be bypassed. 15 15
Using a whitelist? 16 16
Exactly the same issues as the blacklist. 17 17
The best way to do it is to program your web application 18 18
in a way that it does not allow code to be injected into it 19 19
and then executed. 20 20
The best way to do that is to use parameterized statement 21 21
where the data and the code is separated. 22 22
The best way to show you what I mean by that 23 23
is using an example. 24 24
I'm keeping the least amount of programming in this example. 25 25
I don't want it to be a programming example. 26 26
There's actually mistakes in the programming in there, 27 27
but I'm trying to give you the concept 28 28
more than how to program it. 29 29
The vulnerable code that we were looking at used to do this. 30 30
It used to do select * from accounts where username is equal 31 31
to whatever we put in textbox1. 32 32
Then we used to put in textbox1, 33 33
let's just put it here, 34 34
we used to say admin, 35 35
and then close the quote. 36 36
Then we're able to do a union select, 37 37
and execute something else. 38 38
Then once we're done, we used to add the comment 39 39
which, basically, ignores everything that comes in after it. 40 40
So, when you copy this, 41 41
and you paste it in here, 42 42
you'll see what's happen. 43 43
Now, let's just get rid of this 44 44
because this is just making the colors not nice. 45 45
(mumbles), actually, gonna just put a comment on this. 46 46
It's gonna do a select * from accounts 47 47
where username is equal to admin, 48 48
union select and execute whatever we want to do. 49 49
This is very bad and it's very hard to protect against. 50 50
As I said, using filters and stuff, 51 51
we'll only hide the problem, we'll not fix it. 52 52
The best way to do this 53 53
is using the parameterized statements just like so. 54 54
This is the safe way to do it. 55 55
First of all, you prepare your statement. 56 56
Most languages like PHP and all of them, 57 57
they, actually, have a function like that. 58 58
You can prepare select * from accounts 59 59
where username is equal to question mark. 60 60
Then you send the values. 61 61
So, PHP now knows. 62 62
The SQL statement is select * from accounts 63 63
where username is equal to something. 64 64
Then it's gonna take the value of textbox1. 65 65
So, even if we come in and we use our 66 66
very sneaky statement right here, 67 67
and paste it in there, 68 68
the web application will know that the value for this 69 69
is admin union select. 70 70
It'll, actually, try to go 71 71
and select * from accounts where the username, 72 72
and then it, actually, it'll add its own quotes 73 73
and try to find a username with the following username. 74 74
This whole thing will be executed like so. 75 75
So, it'll be select * from accounts 76 76
where username is equal to admin union select, 77 77
this hashtag. 78 78
Whatever you put in your text box will be sent as a value. 79 79
The web application will know that this is a value, 80 80
it's not a code, and it'll never execute it. 81 81
Therefore, this will protect you against SQL injections. 82 82
You can use the filters as second line of defense, 83 83
and I also advice that you use 84 84
the least privileges possible. 85 85
For each database, use one user 86 86
with the least amount of privileges they want. 87 87
Don't allow the users to do anything that they want. 88 88
If it's a simple website that only does selection, 89 89
then only allow the user to select. 90 90
If it only needs to select and insert, 91 91
then only allow them to select and insert. 92 92
This is a rule you should keep with everything, 93 93
even with Linux systems. 94 94
Make sure the permissions are always as least as possible. 95 95
Each user don't have any extra permissions 96 96
that they don't need.