Sql Injection Techniques

WOW...... 

I am speechless, I in fact tried, the SQL injection for some of the sites(which I don't want to mention)

it works.  Hurraaaaaaaaaaaaaaay.

Some of the tricks can be 

• anything' OR 'x'='x
  
• 'or 1=1--

I tried above in password field text box as

user name -> admin

password ->anything' OR 'x'='x

Reason 

Because the application is not really thinking about the query - merely constructing a string - our use of quotes has turned a single-component WHERE clause into a two-component one, and the'x'='x' clause is guaranteed to be true no matter what the first clause is

The following line of code illustrates this vulnerability:

statement = "SELECT * FROM users WHERE name = '" + userName + "';"

This SQL code is designed to pull up the records of a specified username from its table of users. However, if the "userName" variable is crafted in a specific way by a malicious user, the SQL statement may do more than the code author intended. For example, setting the "userName" variable as

anything' OR 'x'='x

renders this SQL statement by the parent language:

SELECT * FROM users WHERE name = 'anything' OR 'x'='x';

If this code were to be used in an authentication procedure then this example could be used to force the selection of a valid username because the evaluation of 'x'='x' is always true.

While most SQL Server implementations allow multiple statements to be executed with one call, some SQL APIs such as php's mysql_query do not allow this for security reasons. This prevents hackers from injecting entirely separate queries, but doesn't stop them from modifying queries. The following value of "userName" in the statement below would cause the deletion of the "users" table as well as the selection of all data from the "data" table (in essence revealing the information of every user):

a';DROP TABLE users; SELECT * FROM data WHERE name LIKE '%

This input renders the final SQL statement as follows:

SELECT * FROM Users WHERE name = 'a';DROP TABLE users; SELECT * FROM DATA WHERE name LIKE '%';