SQL Injection Attack: Quick View

Abstract

SQL injection is a type of security vulnerability that occurs in database-driven web applications where an attacker injects malicious code into the application to gain unauthorized access to sensitive information. This paper aims to provide a comprehensive and systematic review of the existing methods for preventing and detecting SQL injection attacks. The review covers a range of techniques, including input validation, parameterized queries, and intrusion detection systems, as well as the advantages and disadvantages of each method. The most common prevention techniques include input validation, parameterized queries, and stored procedures, while the most common detection techniques include intrusion detection systems (IDS), honeypots, and signature-based detection. The choice of method will depend on the specific requirements of the organization and the level of security required. Still, a combination of prevention and detection methods is likely to be the most effective way to secure web applications against SQL injection attacks. The paper concludes that SQL injection attacks continue to be a significant security threat to web applications, and it is essential for organizations to implement effective prevention and detection methods to secure their web applications against SQL injection attacks.

Cybersecurity for Sustainable Smart Healthcare: State of the Art, Taxonomy, Mechanisms, and Essential Roles

“…Many SHSs are web-based and store healthcare data in SQL databases, making them susceptible to SQL injection (SQLi) attacks. Noman and Abu-Sharkh [117] and Abdullayev and Chauhan [118] define SQLi attacks as a type of application security susceptibility in which cybercriminals exploit SQL database weaknesses by injecting malicious SQL codes/statements into the input fields of a website and desktop and mobile application forms or URL parameters to compromise the back-end database and illegally access and extract sensitive data stored in the database. Numerous websites implement SQL to manage their database, and attackers take advantage of the weaknesses in SQL to execute malicious SQL statements, which allows the servers to reveal sensitive information stored in the databases.…”

“…[118]. In smart healthcare, patients and healthcare professionals use smart healthcare software to access data that can be shared with other departments.…”

Navigating the Cyber Threat Landscape: A Comprehensive Analysis of Attacks and Security in the Digital Age

“…Web applications susceptible to SQL injection can grant attackers unrestricted access to the underlying databases (Halfond et al, 2006;Nasereddin et al, 2021;Sadeghian et al, 2013;Singh et al, 2016). The storage of sensitive user or consumer data in these databases often results in substantial consequences in the event of security breaches (Abdullayev & Chauhan, 2023;Clarke, 2009). The ramifications include identity theft, the divulgence of personal data, and the commission of deceitful activities.…”

Assessment of existing cyber-attack detection models for web-based systems

“…SQL attack is a method where the attacker uses malicious cod to gain access to information by backend database manipulation [56]. Information attackers target may be details of the targeted organization, details of the company's customers or users of the company's systems and networks which results to illegitimate viewership of sensitive information, deletion or modification [57], [58], [59]. SQL injections can be prevented by implementing input validation which would flag unlawful input.…”