SQL Injection is a security exploit in which the attacker injects specially crafted query through a web form input box to gain access into database
Programmers use sequential commands in their program making it easier for attacker to inject code while taking user input

Example see the below code,

var Shipcity;
ShipCity = Request.form ("ShipCity");
var sql = "select * from OrdersTable where ShipCity = '" + ShipCity + "'";

The user is prompted to enter the name of a city. If user enters Bangalore, the query assembled by the script looks similar to the following:
SELECT * FROM OrdersTable WHERE ShipCity = ‘Bangalore'

However, assume that the user enters the following:

Bangalore'; drop table OrdersTable–
In this case, the following query is assembled by the script:

SELECT * FROM OrdersTable WHERE ShipCity = ‘Bangalore';drop table OrdersTable--'

When SQL Server processes this statement, SQL Server will first select all records in OrdersTable where ShipCity is Bangalore. Then, SQL Server will drop OrdersTable.

SQL Injection - Safety measures

The fields which take input from the user are enclosed by a single quote (‘)
To test, enter (‘) as user name. If the following error message is displayed then the website is vulnerable to SQL Injection attack,

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft] [ODBC Microsoft Access Driver] Extra)
in query expression 'Userid='3306' or ('a'='a' AND Password=".

/_booking/login3.asp, line 49



Following to be considered when doing Database Testing,

1. Disabling verbose errors
2. Never trust user inputs. Always validate user input by testing type, length, format, and range
3. Not connecting to database using an admin level account