Chapter 16. SQL Injection

Having addressed Unix and Windows attacks in general, we will now briefly touch on the exciting, multi-platform area of attacking databases via SQL injection. This chapter covers various database attack methods and defense approaches and culminates in a real-life SQL injection attack against PHP-Nuke, a database-driven ^[1] open source web site framework that has displayed many of the flaws we describe.

^[1] "Database-driven" is used to specify an application linked to a backend database for data storage, authentication, and other purposes.