Database Security For Preventing Sql Injection

Vulnerability 3: Cross-Site Scripting (XSS): It is one of the most common application layer hacking techniques ("What is cross-site," 2015).

SQL Injection – an input validation attack specific to database applications where SQL code is inserted into application queries to manipulate the database.

In this thesis, focus on the security aspect of the client side, as well as in terms of the server, where the main objective of this security system to prevent attackers from exploiting the weaknesses of the client side because this would lead ultimately

Vulnerability: Existence of a weakness, design or implementation error that can lead to an unexpected and undesirable event compromising the security of the system.

2. Digest Authentication- This type of authentication mechanism requires the username and password to be hashed using MD5 and then they are compared with the SQL server.

Eavesdropping, breaking and entering, social engineering, malicious code, session hijacking, man-in-the-middle attacks, wireless hacking, SQL injections, web site attacks, and more.

Web application security is a form of security that deals specifically with the security of websites, their applications and web services. At advanced levels, web application security touches on the principles of web application security but applies them directly to Internet and Web systems.

The Aim Higher college has recently had some issues of sensitive information being stolen from students when registering for classes. I believe that the web application that the student information system is using is a problem named SQL injection. A SQL injection attack is an attack where the attacker can run malicious SQL queries against a web application’s database server and it can be a danger for the users who access the web page because the hacker will look for their personal information records, then delete it or modify the information gained. This type of attack is no joke we have to take action and create a plan to resolve this vulnerability on our database, so the students will register for their courses with our security on their side.

From the above code, we can tell how server send query to Database. But we can still guess to login without knowing the user’s passward by typing “bob’);-- “( space after the comment’--’ )

A majority of the software risks are associated with the poor programming practices, such as allowing changed in web page or SQL query structures; unrestricted upload of files; improper handling of operating system commands and log message content; unchecked Uniform Resource Locator (URL) redirection and race condition; inappropriate resource management; and weaker defenses including access control, authentication, encryption, and critical resource allocation porousness (Stallings & Brown, 2012). One of the most popular web application attacks is known as Cross Site Scripting (XSS), where the attacker maligns a vulnerable web page or server. When a user visits the compromised web page, the infected code executes in the browser using the web server privileges. XSS attacks can be of many forms, such as: reflected XSS, where the server directly processes the infected script; persistent XSS, where a stored infected script in the server is passed to the client’s browser and gets stored there; stealing of cookies; defacement of the web pages; phishing; execution of exploits; and violation of privacy (Chugh & Gupta,

-evaluate the impact of such a breach on the security of confidential information and on the infrastructure of the website.

Injection Attacks where the attacker deposits the scripts into a web request to execute at the client-end (Wadlow, 2009).

Web applications are nowadays serving as a company’s public face to the internet. This has created the need to identify threats and attacks directed to data servers and web applications. Hackers exploit vulnerabilities in input validation and authentication affecting the web application in order to gain illegal access and disclose sensitive data or manipulate it to their benefits.

With advances in technology constantly happening, it can be hard to keep up with all of the latest trends. If organizations cannot keep up with the latest trends, it can lead to flaws in their security. Any flaws in security can have a detrimental effect on an organization’s database. Almost every organization has some sort of database, whether it is for maintaining customers, inventory, or vital information.

Figure 2.7: A line of code illustrates SQL injection vulnerability. This method forces the selection of a valid username because the evaluation of '1'='1' is always true.