Securing SQL Server: DBAs Defending the Database

© Peter A. Carter 2018

Peter A. CarterSecuring SQL Serverhttps://doi.org/10.1007/978-1-4842-4161-5_10

10. SQL Injection

Peter A. Carter¹ 

(1)

London, UK

 

SQL injection is a form of attack where the attacker will attempt to enter T-SQL statements in fields of an application where standard user input is expected. This results in the application building valid, but unintended, harmful statements that could cause serious damage to the SQL Server environment and potentially even allow the attacker to target the wider network. All RDBMS’s (Relation Database Management Systems) are vulnerable to SQL injection attacks because of the very nature of the SQL language, but steps can be taken to mitigate the risks.

In this chapter, after building a vulnerable environment, ...