As you've seen so far as skill injections are very dangerous and also they're very easy to Ocker and
very easy to find.
You'll find them everywhere in some really famous websites.
People try to prevent these vulnerabilities using filters.
Filters can make it look like there is no exploits but if you actually try harder by using encoding
different types of encoding or using a proxy then you'll be able to bypass most of these filters.
Some programmers use a blacklist.
So for example they prevent the use of union.
They prevent the use of insert and stuff like that.
Again it's not 100 percent secure.
It can be bypassed using a whitelist.
Exactly the same issues as the blacklist.
The best way to do it is to program your web application in a way that it does not allow code to be
injected into it and then execute it.
So the best way to do that is to do to use parameterize statement where the data and the code is separated.
And the best way to show you what I mean by that is using an example I'm keeping the least amount of
programming.
In this example I don't want it to be a program and example.
There's actually mistakes in the programming in there but I'm trying to give you the concept more than
how to program it.
So the vulnerable code that we were looking at used to do this so it used to do select star from accounts
where username is equal to whatever we put in text box 1 and then we used to put in text box 1.
Let's just put it here.
We used to say as men and then close the code and then we're able to do a union select and execute something
else.
And then once we were done we used to add the comment which basically ignores everything that comes
in after it.
So when you copy this and you put it in here
you'll see what's happening.
So it's selection.
Now let's just get rid of this because this is just making the cut is not nice and I'm actually going
to just put a comment on this so it's going to do a select from accounts where user name is equal to
Aardman Union select and execute whatever we want to do.
This is very bad and it's very hard to protect against.
As I said use filters and stuff all only highlight the problem will not fix it.
The best way to do this is using the parameterize statements just like so.
So this is the safe way to do it.
First of all you prepare your statement most languages like BHB and all of them they actually have a
function like that and you can prepare select starer from accounts where a user name is equal to a question
mark and then you send the values.
So ph we now knows the skill statement is select star from accounts where user name is equal to something
and then it's got the value of text box 1.
So even if we come in and we use our very sneaky statement right here and pasted in there the web application
will know that the value for this is admen Union selects out alive.
She try to go and select start from accounts where the user name username and then it actually it'll
add its own quotes and they try to find a username with the following username.
So this whole thing will be executed like so
so it will be next from accounts where username is equal to as many union select this hashtag.
So it'll never lever whatever you put in your text box will be sent as a value and the web application
will know that this is a value.
It's not a code and it'll never executed.
Therefore this will protect you against Escurial injections.
You can use the filters as a second line of defense.
And I also advise that you use the least privileges possible so use for each database use one user with
the least amount of privileges they want so don't allow the users to do anything that they won't allow
them.
If it's a simple website that only do the selection then only allow the user to select if it only needs
to select and insert then only allow them to select an answer.
And this is a rule you should keep with everything even within existence.
Make sure the person with the permissions are always as these as possible.
Each user don't have any extra permissions that they don't need.