SQL Injection and Security
A few more details than in Section 9.5 of the zyBook
Database Security 101
Example Threats
Example Controls
Exploits of a Mom
Traffic Cameras
Other Examples
Hello, my name is: ' OR '1' = '1
SELECT * FROM users�WHERE name = '' OR '1' = '1';
Or, my password is: ' OR 1 = 1; --
SELECT * FROM users�WHERE name = '' OR 1 = 1; --';
Little Bobby Tables: '; DROP TABLE users; --
SELECT * FROM users�WHERE name = ''; DROP TABLE users; --';
NEVER CONCATENATE USER INPUT!
sql = "SELECT * FROM users\n" \
f"WHERE name = '{userName}';"
What can SQL injection do?
Add or modify data
Bypass authentication
Extract data
Examples:�https://en.wikipedia.org/wiki/SQL_injection
How to prevent attacks
Your application should:
Your user account should:
Your db server should: