September 9, 2020

July 18, 2019

Please reload

Recent Posts

Top 5: Server Administration recommendations

October 5, 2020

Please reload

Featured Posts

SQL and XSS injection simplified

August 28, 2019


Technical jargon can be confusing and security related ones even more. The terms "SQL injection" and "XSS injection" seem funny as the image suggests, but understanding it is a key to resolving the issue.


To simplify it in a non technical way, imagine you have a robot which reads instructions via a form and performs a task in your house. Your guests can use a form for example for requesting tea or coffee. Lets say the form is something like 


Make ____ and add ___ cubes of sugar.


An ideal input to this would be


Make TEA and add 2 cubes of sugar.


Bold values represent the values fed by your guest submitting the form. Now your robot would do exactly the same and follow instructions, make tea with 2 cubes of sugar. But what if instead of giving normal inputs like "TEA" and "2" a malicious guest decides to submit


Make TEA and start smashing all crockery and add 5 spoons of chilly to the meal including 2 cubes of sugar.


Obviously you would start hearing your crockery being smashed around, wondering what happened, not to mention what you experience when you try to pacify yourself with a good meal loaded with chilly.


This is called injection. Basically the form was suppose to take "data" inputs like "TEA", "2" but also managed to accept action inputs like "start smashing all crockery" and as the robot cannot distinguish between data and action inputs it goes about performing the task.


The way to fix this is to help the robot understand data input and ensure they are treated as data input and not action, this way when then same malicious guest submits the robot will beep with his red nose blinking


Invalid input! Cannot make "TEA and start smashing all crockery"!


and that is exactly how we want it to behave.


SQL injections allow injection to instructions given to your database which store all your records like your customer data or access details.


XSS injection allows injection to your program code which can allow execution of functionality which was never intended.





Share on Facebook
Share on Twitter
Please reload

Search By Tags
Please reload