HackingRoXX

I am posting the best tutorial which i think.....for the starters..

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application.

Forms of vulnerability :-

1>Incorrectly filtered escape characters

This form of SQL injection occurs when user input is not filtered for escape characters and is then passed into an SQL statement.

let understand by an example :-
statement = "SELECT * FROM users WHERE name = '" + userName + "
';"
now set "userName" variable as a' or 't'='t
Then the strings will be in the form SELECT * FROM users WHERE name = 'a' OR 't'='t'; which will bypass the existing sql string.That can also be used for multiple statement execution for example :- a';DROP TABLE users; SELECT * FROM data WHERE name LIKE
'%
the string will be in this form SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM DATA WHERE name LIKE '%';

2>Incorrect type handling :-This form of SQL injection occurs when a user supplied field is not strongly typed or is not checked for type constraints.
For example :- statement := "SELECT * FROM data WHERE id = " + a_variable + ";"
For example, setting a_variable to 1;DROP TABLE users
Since the SQL would be rendered as follows:-
SELECT * FROM DATA WHERE id=1;DROP TABLE users;