Basic Introduction
SQL injection is one of the more common methods for achieving data leakage. The core of the attack is appending SQL commands to the backend of a Web or application (usually via a website) with the aim of disrupting the original SQL script and then executing the SQL script that has been injected into the form fields. This type of SQL injection most commonly occurs when SQL is dynamically generated in client applications. The root cause of SQL injection attacks lies in security oversights present in client applications and database stored procedures, and developers do not pay sufficient attention to this issue when building new applications. There are two relatively common types:
Stacked Injection
Stacked injection is the simplest and most convenient injection method. As long as the original SQL statement has an end marker (such as a semicolon ;), and the backend does not limit the number of SQL statements that can be executed in one request, attackers can append and execute additional SQL statements.
For example:
SELECT * FROM user WHERE userid = 100; SELECT version();Boolean Injection
Boolean is a basic data type in computers, having only two values: true and false. Boolean injection mainly uses functions such as length() and substr() to guess and decrypt database information (such as version, table names, field names, etc.) character by character by observing the true or false state returned by the page.
The attack process usually consists of two steps:
1. Guess the length of the target string using the dichotomy method, for example:
AND LENGTH(version()) > 22. Compare characters one by one at a fixed position, for example:
AND SUBSTR(version(), 1, 1) = 'h'Attackers can use tools such as Burp Suite or sqlmap to automatically try the 26 letters. They judge the current character based on whether the return result is true, and finally combine the length information to completely restore the target string.
How to Prevent
When using Java to connect to the Halo database via JDBC, you should use the PreparedStatement with a pre-compilation mechanism. The core practice is: using placeholder '?' in the SQL statement to replace dynamic parameters, and passing in actual values through methods like setString().
The PreparedStatement object sends the SQL template and parameters to the database server separately. The database will pre-compile the SQL template before execution to verify grammatical correctness. If the compilation is successful, it caches the execution plan and binds the parameters for execution; if it fails, it reports an error directly, without executing malicious concatenated logic, thereby effectively blocking SQL injection.
Basic Principles
The pre-compiled statement java.sql.PreparedStatement extends from Statement, possessing all the functions of Statement, and also provides stronger security and performance advantages. Unlike Statement, PreparedStatement receives the complete SQL template (containing ? placeholders) when creating the object, and the database will pre-compile this template immediately. This makes the subsequent execution speed faster, especially effective when repeatedly executing or processing complex statements.
Summary
This article introduced the basic knowledge of SQL injection and defense methods. We hope you can understand the essence of SQL injection and strengthen your awareness of security standards in subsequent development work to avoid illegal operations or data leakage risks to the Halo database.