How does code injection work?

Code injection, often referred to as remote code execution (RCE), is an attack perpetrated by an attacker's ability to inject and execute malicious code into an application; injection attack. This foreign code is capable of violating data security, compromising database integrity or private properties. In many cases, it can bypass the authentication check, and these attacks are usually associated with applications whose execution depends on user input.

ContentsTypes of Code InjectionsHow SQL Injections WorkWhat SQL Injection Can DoHow to Prevent SQL InjectionsScript InjectionHow to Prevent Script InjectionsConclusion

Typically, applications are more vulnerable if code is executed without first going through validation. A simple case of vulnerable code is shown below.

In the code above, the attacker could insert a payload that would modify the SQL statement executed by the database server. An example would set the password field to:

password’ OR 1=1

This automatically causes the following statement to be executed on the database server:

SELECT id FROM users WHERE username='username' AND password='password' OR 1=1

What SQL injection can do

This is the most common type of code injection. Considering that SQL is the language used to manipulate data stored in relational database management systems (RDBMS), an attack with the power to give and execute SQL statements can be used to access, modify and even delete data.

This can give the attacker the ability to bypass authentication, have full disclosure of data stored in the database, compromise data integrity and cause repudiation issues, alter balances and cancel transactions.

How to prevent SQL injections

There are a few steps to make your apps less vulnerable, but before each step, it's best to assume that all user-submitted data is bad and don't trust anyone. Then you can consider the following:

• Disable the use of dynamic SQL – it means not building database queries with user input. If necessary, sanitize, validate, and escape values ​​before performing a query with user input data.
• Use a firewall – A web application firewall (software or app based) will help filter out malicious data.
• Buy better software – It just means that the coders will be in charge of checking and correcting the defects.
• Encrypt or hash passwords and any other confidential data you have, this should include connection strings.
• Avoid connecting to your database with privileged administrator accounts unless you absolutely need to.

Script injection

This security vulnerability is a threat that allows an attacker to inject malicious code directly into web forms of data-driven websites through user interface elements. This attack is often called Cross-Site Scripting or XSS. the