As you have seen so far, Eskil, injections are very dangerous and also they're very easy to occur
and very easy to find.
You'll find them everywhere.
And some really famous websites, people try to prevent these vulnerabilities using filters.
Filters can make it look like there is no exploits.
But if you actually try harder by using encodings, different types of encoding or using a proxy, then
you'll be able to bypass most of these filters.
Some programmers use a blacklist.
So, for example, they prevent the use of union.
They prevent the use of insert and stuff like that.
Again, it's not 100 percent secure.
It can be bypassed using a whitelist.
Exactly the same issues as the blacklist.
The best way to do it is to program your Web application in a way that it does not allow code to be
injected into it and then execute it.
So the best way to do that is to do to use parameterized statements where the data and the code is separated.
And the best way to show you what I mean by that is using an example.
I'm keeping the least amount of programming in this example, I don't want it to be a programming example,
there's actually mistakes in the programming in there, but I'm trying to give you the concept more
than how to program it.
So the vulnerable code that we were looking at used to do this, so it used to do select staff from
accounts where username is equal to whatever we put into Xbox One.
And then we used to put an Xbox One.
Let's just put it here.
We used to say admen and then close the quote.
And then we're able to do a union, select and execute something else, and then once we're done, we
used to add the comment, which basically ignores everything that comes in after it.
So when you copy this.
And you pasted in here.
You'll see what's happening, so it's selection now let's just get rid of this.
Because this is just making the colors not nice, I'm actually going to just put a comment on this.
So.
That's going to do a select staff from accounts where user name is equal to admin, union, select and
execute whatever we want to do.
This is very bad and it's very hard to protect against.
As I said, using filters and stuff will only hide.
The problem will not fix it.
The best way to do this is using the parameterized statements, just like so so this is the safe way
to do it.
First of all, you prepare your statement.
Most languages like you and all of them, they actually have a function like that.
And you can prepare select star from accounts where username is equal to questionmark.
And then you send the values so BHP now knows the Ezekial statement is select staff from accounts where
username is equal to something and then it's going to take the value of the Xbox One.
So even if we come in and we use our very sneaky statement right here.
And pasted in there.
The Web application will know that the value for this is admen union select, so it will actually try
to go and select staff from accounts where the user name and then it actually it'll add its own quotes
and they try to find a username with the following username.
So this whole thing will be executed like soap.
So it will be selected from accounts where user name is equal to admen union, select this hash hashtag
so it'll never whatever you put in your.
Textbooks will be sent as a value and the Web application will know that this is a value, it's not
a code, and it'll never executed.
Therefore, this will protect you against Ezekial injections.
You can use the filters as second line of defense.
And I also advise that you use the least privileges possible.
So use for each database, use one user with the least amount of privileges they want.
So do not allow the users to do anything that they won't allow them.
If it's a simple website that only the selection that only allow the user to select, if it only needs
to select an insert, then only allow them to select and insert.
And this is a rule you should keep with everything, even within the system, to make sure the with
the permissions are always as least as possible.
Each user does not have any extra permissions that they don't need.