What Injection Is
Every injection bug is the same shape: data crosses into code because the two were joined by gluing strings together. See the shape once and you see it everywhere.
People say "SQL injection" like it is one specific trick. Is it?
It is one specific mistake, and it has one specific cure. The trick is just what the mistake lets an attacker do. Start with the mistake.
Data that becomes code
A program keeps data and code in separate worlds. Your name is data; the instruction that looks your name up is code. Injection is what happens when data crosses the border into code — when something you typed stops being treated as a value and starts being treated as an instruction.
It crosses that border for one reason, every time: the program built its instruction by gluing strings together, and your text was one of the pieces. Once your text is part of the instruction, anything that reads as an instruction *is* one.
How the bug is written
query = "select * from users where name = '" + input + "'"What an attacker sends
input = "' OR 1=1 --"The application meant the quotes to wrap a value. The attacker closes the first quote early, writes a condition of their own, and comments out the rest. Nothing was hacked; the string was just built to say something else.
Before we run anything: why does OR 1=1 return every row, rather than an error?
1=1 is true for every row, and OR only needs one side to be true. The condition the application wrote — matching a name — is joined by OR to a condition that is always true, so every row matches. It is ordinary SQL doing exactly what SQL does. That is the uncomfortable part: nothing malfunctioned.Legal
Everything in this course runs against targets we built to be broken, on an isolated domain, with data that is not real. Running the same techniques against a system you do not own is a criminal offence in most countries — the skill is legal, using it without permission is not.