Stacked Queries SQL Injection (SQLi)

A semicolon(;) is used to terminate a statement in SQL. By deleting the original queue and adding new one by the attacker changes data in the database. This is a massively used SQL injection attack. A semicolon allows the attacker to execute multiple statements into the database. This has similarity to Union based injection attack. But, union based injection can only be done using SELECT statements. But in stacked queries SQL injection, the attack can be done using any SQL statement. This generates a huge vulnerability. The attacker can use this vulnerability to make changes to the database.

Example

        /*Malicious user input by attacker*/
        1; DELETE FROM products
        
        /*This example executes multiple statements*/
        SELECT * FROM products WHERE productid=1; DELETE FROM products

    

Impact and Fixes

Written by

Manindar Mohan

Cyber Security Lead Engineer

Manieendar is a dedicated Security Engineer with a wealth of experience in the cybersecurity landscape. He plays a pivotal role at Beagle Security, where he employs his extensive knowledge to safeguard systems against cyber threats. Manieendar's passion for cybersecurity extends beyond his professional role; he actively contributes to the online security community through insightful articles and speaking engagements.