What is SQL Injection in Java?

What is the SQL Injection technique?

SQL Injection (SQLi) is a widely used code penetration technique which uses SQL queries to attack and destroy databases.

SQL injection is one of the top 10 web application vulnerabilities that hackers use to violate cyber laws and steal data.

Hackers and attackers use SQL injection to manipulate Java web applications.

Why is SQL injection so popular?

Most Java web applications are heavily secured and implement algorithms to prevent cyber attacks. However, a code flaw can still lead to SQL injection.

SQL injection is popular because of the following:

• It is easy to learn.
• We can easily execute SQL queries.
• The Target.Database statement contains a lot of important data for applications.

The simplest form of SQL injection is fetching user login details from relational databases such as PostgreSQL, SQL Server, My SQL, etc.

Hackers use this opportunity to leave SQL queries as inputs to the web application and alter the relational databases.

How an SQL injection attack works

So far, we’ve learned that this technique uses SQL queries to damage databases. But how? And what type of SQL queries?

Attackers come up with various ways to access the database and make changes using SQL commands.

Let’s observe an example to understand how hackers implement SQL injection.

Example

We have a login page developed in Java that accepts a username attribute and a password.

On the server-side, we have the following line of code:

String statement = "SELECT * FROM users WHERE username ='admin' AND password = 'something'";

If the attacker receives no output against this SQL query, there is an alternate way to execute it:

String statement = "SELECT * FROM users WHERE username ='admin' OR '1'='1'-- ' AND password = 'something'";

Explanation

Notice the difference between these two statements. The first SQL query asks to SELECT the username admin from all users, WHERE the password is something.

Suppose the first query doesn’t work, as there’s no user admin with the password something.

The attacker types in a malicious query where the statement 1 = 1 is logically true always, and the double hyphens -- denote that anything after them is a comment.

SQL database ignores this comment. Due to the true value of 1 = 1, the database would automatically ignore the password verification phase, allowing the attacker to log in into the application.

How to prevent SQLi attacks

There are several ways to secure our data against unauthorized access. To fight SQL injection attacks, try the following:

• Use SQL injection protection tools available online.

• Regularly update the security of our application.

• Validate our credentials first by setting a fixed length of characters, including special symbols, etc.

• Use the SQL built-in prepared statement with the placeholder:

  PreparedStatement preparedStatement = conn.prepareStatement('SELECT * FROM usercheck where username=?');

• Restrict the number of privileged users to protect against more attacks.

• Set rights for databases so that unauthorized access will not be successful.

• Error messages must be meaningful and not reveal hints or data to attackers.