Bear with me on this one. Most websites (like this one) these days rely on a database to hold information and generate the pages you see in your browser on the fly when you request them. All of the popular databases in use accept commands in a computer language called SQL. A posting like the one you are reading is basically a line or two of SQL that reads the words out of a database and converts them into HTML for your browser to display. When someone uses a SQL injection to attack a site they basically add SQL statements to URLs or fill them into form fields. If the site doesn’t check URLs for correct format or doesn’t closely evaluate what people type into text boxes that SQL code can be sent directly to the database. The code could then write information to the database or read information out of it, information you don’t want anyone to know about like credit card numbers. Recently Rafal Los, an HP security specialist, was testing a site for vulnerability to SQL injections and in the process discovered the site had already been successfully attacked. The site was sending a Trojan to every visitor, totally without the knowledge of the owners.
This work, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.
