What is SQL Injection?
An SQL injection attack “injects” or manipulates SQL code by adding unexpected SQL to a query. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password.
SQL injection is the most common class of attacks on databases, which has been frequently used to steal data such as credit card numbers. The attacker can execute tailored SQL queries by ‘piggy-backing’ on legitimate queries made by applications. With SQL injection you can ask essentially any question of the database – and therefore do anything with the database and the data in it: control the database (for example deleting or corrupting tables or shutting it down) or access computers that trust the network connections to the database. The incidence of SQL injection has been growing at 250% per year, increasingly from criminals motivated by financial gain.
