SQL Injection: A Beginner’s Guide

SQL Injection sounded complicated to me when I first started learning web security. I didn’t understand why some random characters could change what a database does.

The part I was missing was SQL itself.

In this blog, we will learn the basics of SQL query and SQL Injection along with practical lab. Do not miss out the links embedded in underlined words!

Why does SQL Injection seem difficult?

We don’t know what SQL query is.

Before trying complex command, try to learn and understand basic commands.

SQL command basics for SQL Injection

Start with SQL commands such as SELECT, WHERE, INSERT, DELETE, UNION and UPDATE.

And understand some basic SQL characters and operators such as ’,--, =, OR and AND.

You don’t need to become an SQL expert before learning SQL Injection. You just need to understand enough SQL to recognize what your input is changing.

SQL Injection

It’s an injection attack where attacker injects malicious SQL queries on an input field to retrieve, modify or delete the data from database.

Get Jessica’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Simply saying:

SQL Injection happens when an application puts user input directly into an SQL query without handling it safely.

The attacker can manipulate the structure of that query and make the database perform actions the developer did not intend.

Let’s begin with a simple example. Suppose a table named users_table with three column.

users_table
username   | country   |password 
-----------|-----------|------------
megha      | Nepal     | yomantamero
justin     | Australia | heyworld123
patricia   | UK        | okayitsfi
admin      | Combodia  | admin123

Now suppose the application uses this SQL query to find a user:
SELECT * FROM users_table WHERE username = 'admin';

This simply means:
-Find all information from the users table where the username is admin.\
The database would return:
admin | Cambodia | admin123

Let’s try 1=1

Before looking at SQL Injection, let's understand something very basic.

In SQL:

1 = 1 is TRUE.

While:
1 = 2 is FALSE.

We can think of it like a normal comparison:

Is 1 equal to 1? -> TRUE

Is 1 equal to 2? -> FALSE

This is important because SQL uses conditions to decide which rows should be returned.

For example:

SELECT * FROM users WHERE 1 = 1;

The condition is TRUE, so the query can return all rows:

megha
justin
patricia
admin

This doesn't mean 1=1 is automatically SQL Injection. 
It is simply a basic SQL condition that we need to understand before looking at an injection.

Now let’s look at admin’--

Suppose an application has an input field where it takes a username from the user.

Example of input field

Normally, the user enters:

admin and enters the password

and the application creates:

SELECT * FROM users WHERE username = ‘admin’;

Now imagine the user enters:

admin’--

The application could end up creating a query like:

SELECT * FROM users WHERE username = ‘admin’--‘;

Let’s break it down:

admin -> The existing username

‘ -> Closes the string ‘admin’

-- -> Starts a SQL comment

So instead of the application treating the entire input as just a username, the input has changed the structure of the SQL query.

That is the basic idea behind SQL Injection.

The important thing here isn’t memorising admin’--.

It’s understanding what each character is doing to the original SQL query.

Now let’s try the practical lab

SQL injection vulnerability allowing login bypass

That’s all! See you in next blog.