SQL injection will occur only when there is a form to submit?

Question

I am confused about sql injection how about the $_GET or other instance that it can happen like the things I don't know?..

Answer 1

SQL injection happens whenever you have data submitted by a user that you integrate into a query and pass to the server without checking it. This could just as easily occur with a GET parameter.

Consider if you have user pages at: /user/{userid}

Someone requests: /user/1;DROP TABLE users;

If you were building a query like this:

SELECT * FROM users WHERE id=$userId

... that query would now be:

SELECT * FROM users WHERE id=1;DROP TABLE users;

So you can see why this might be an issue.

Answer 2

Sorak already answered your question, but to give more details..

SQL injection vulnerability is exploitable when the SQL query in your application is being formed with user supplied data without proper sanitization. It could be done many ways For ex.

• a form with POST request
• or a blog post/dynamic web page (GET request) with URL parameters (http://example.com/?postid=212)
• or a RESTful resource with path parameters (http://example.com/postid/212)
• or even in JSON/XML request submitted to an API or application.

Not only in web applications, but also back end APIs are vulnerable for this attack if data validation is not done properly before executing SQL queries, because the api consumer can inject malicious queries to take over the server/corrupt the data/dump entire table or even DB if possible.

For ex. Facebook API has to deal with 1000's of third party applications/mobile apps on daily basis. Lets suppose if the API is vulnerable to this attack then any of these API consumers can exploit it to gain some control over app servers/data based on the severity of the injection.

Answer 3

SQL injection can happen anywhere where user has control over SQL query parameters sent to database engine. This includes GET / POST, etc.

Consider we have database table COMPANY, where we are saving company data and WORKER table which saves employee salaries. We would like to build a page which extracts from database companies list established on a date supplied by a user in URL.

Our code is :

<?php

class RamDb extends SQLite3
{
    function __construct()
    {
        $this->open(':memory:');
    }
}

$db = new RamDb();

// table mockup
$db->exec("CREATE TABLE COMPANY(
                       NAME STRING,
                       ESTABLISHED INT
                              )
          ");
$db->exec("CREATE TABLE WORKER(
                       NAME STRING,
                       SALARY INT
                              )
          ");

$db->exec("insert into company(name, established) 
           select 'TotalFun Inc.', 1970 
           union 
           select 'Cheap Prices, LLC', 1970
           ");

$db->exec("insert into worker(name, salary) 
           select 'Tadeus Mackevic', 120000
           union 
           select 'Sandra Lipkovic', 230000
           ");

$sql = "SELECT * FROM company WHERE ESTABLISHED = {$_GET['year']}";

$result = $db->query($sql);

$data = [];
while($row = $result->fetchArray(SQLITE3_ASSOC)) {
    $data[] = $row;
}

var_dump('<xmp>',$data, '</xmp>');

Now if normal user requests companies created on 1970 year, like that http://localhost/companies.php?year=1970, then we get companies list:

array(2) {
  [0]=>
  array(2) {
    ["NAME"]=>
    string(17) "Cheap Prices, LLC"
    ["ESTABLISHED"]=>
    int(1970)
  }
  [1]=>
  array(2) {
    ["NAME"]=>
    string(13) "TotalFun Inc."
    ["ESTABLISHED"]=>
    int(1970)
  }
}

However what if some malicious user would like to get employees salaries instead of company list ? Then he/she could use SQL injection by submiting such URL http://localhost/companies.php?year=0%20union%20select%20name,%20salary%20from%20worker and get worker salaries list:

array(2) {
  [0]=>
  array(2) {
    ["NAME"]=>
    string(15) "Sandra Lipkovic"
    ["ESTABLISHED"]=>
    int(230000)
  }
  [1]=>
  array(2) {
    ["NAME"]=>
    string(15) "Tadeus Mackevic"
    ["ESTABLISHED"]=>
    int(120000)
  }
}

In general SQL injection means submitting SQL statements along with field values to web server