SQL injection occurs when application input is inserted into a dynamically built SQL statement and interpreted as executable T-SQL. The resulting statement may authenticate an attacker, expose information, destroy data, or enable movement into other environments. Application validation matters, but database administrators remain the last line of defense. section 14.7 section 14.8
Three mistakes make SQL injection especially dangerous:
- Mistake 1—trusting application developers alone: input validation can be missing or defective, so database permissions and configuration must provide another defensive layer. section 14.7
- Mistake 2—combining injection with excessive privilege: a highly privileged service account, enabled xp_cmdshell, or an active sa account can turn a login flaw into broader environmental damage. section 14.7
A login page that stops checking passwords
A vulnerable login page constructs a query from the supplied user name and password. Normal input produces a statement such as SELECT * FROM Users WHERE UserName='Pete' AND UserPassword='Password1'. Crafted input can alter the predicate to an always-true condition and comment out the remaining password check. The same test values fail when passed as parameters to a login stored procedure.
