1. Executive Summary & Scope
SQL Injection occurs when untrusted user input is directly concatenated into dynamic SQL query strings, allowing malicious input to break out of data context and alter query structure. Attackers can bypass authentication, read arbitrary database contents, modify records, or execute operating system commands.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-89 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
Attackers inject boolean payloads, stacked queries, or union queries (e.g. `' UNION SELECT username, password_hash FROM users--`) into search parameters to extract all sensitive corporate records.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Direct string interpolation into SQL query
$username = $_POST['username'];
$query = "SELECT * FROM accounts WHERE username = '" . $username . "'";
$result = $db->query($query);
Hardened Defense-in-Depth Implementation
// REMEDIATED: Parameterized prepared statements with strict type binding
$username = (string)$_POST['username'];
$stmt = $pdo->prepare("SELECT id, username, email, role FROM accounts WHERE username = :user");
$stmt->execute([
':user' => $username
]);
$account = $stmt->fetch();
// Ensure emulated prepares are disabled in PDO setup:
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Single Quote / Breakout Fuzzing | Inject single quotes, double quotes, backslashes, and comment indicators (`--`, `/*`). | Server treats all payload characters as literal data strings; zero syntax errors produced. |
| Time-Based Blind Injection Fuzzing | Send payloads containing `WAITFOR DELAY` or `pg_sleep(5)` or `SLEEP(5)`. | Response time remains completely unaffected by sleep payloads. |
| Static Query Audit | Scan repository with SAST tools for raw variable concatenation in SQL strings. | Zero occurrences of `$db->query("...$var...")` found across codebase. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.