17. Why Learn All This Before Kali Linux?
17.5 From MySQL to SQL Injection
SQL injection (SQL इंजेक्शन) ajunahi web applications madhla sarvaat dhokadayak bug aahe. Part 5 madhe SELECT ... WHERE shiklat – aata tyach query cha gairvapar kasa hoto te samjel.
// VULNERABLE – user input glued into SQL text (never do this)
$sql = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'";
// input: ' OR '1'='1 → WHERE username = '' OR '1'='1' → every row matches!
// SAFE – prepared statement (what our reels project uses everywhere)
$stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE username = ?');
$stmt->execute([$_POST['username']]);
| You learnt (Part 5) | Attack side | Defence side |
|---|---|---|
WHERE, OR, comments (--) |
Classic ' OR '1'='1 login bypass |
Prepared statements |
UNION, SELECT columns |
UNION-based data extraction | Prepared statements, no verbose errors |
information_schema |
Enumerating tables and columns | Least-privilege DB user |
Users and GRANT |
Reading other databases, DROP TABLE |
App user with only needed privileges on one database |
| Safe update mode, backups | Destructive injected queries | Backups, monitoring, WAF as an extra layer |
Why this matters for security
sqlmap automates injection, but it cannot tell you why the bug exists or how to fix it. Because you know SQL and PDO, you can read the vulnerable line, prove it in DVWA (your lab only), and write the one-line fix – and explain why least privilege on RDS would have limited the damage anyway.
Ravindra Bagale's Tip
Many students suggest the fix "remove the quote ' from the input" – that's wrong, it can be bypassed. In an interview, give one answer: prepared statements (parameterised queries), along with a least-privilege DB user and input validation. This question comes up in almost every security interview – remember it.
Ravindra Bagale's Tip – मराठी
बरेच students "input मधून quote ' काढून टाका" असा fix सांगतात – तो चुकीचा आहे, bypass होतो. Interview मध्ये एकच उत्तर द्या: prepared statements (parameterised queries), त्यासोबत least-privilege DB user आणि input validation. हा प्रश्न जवळजवळ प्रत्येक security interview मध्ये येतो, लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
बहुत से students "input से quote ' हटा दो" जैसा fix बताते हैं – यह गलत है, bypass हो जाता है. Interview में एक ही जवाब दो: prepared statements (parameterised queries), साथ में least-privilege DB user और input validation. यह सवाल लगभग हर security interview में आता है, याद रखो.
Practice task
Take the vulnerable line above and write, on paper, what the final SQL becomes for the inputs admin' -- and ' OR '1'='1. Then point to the exact lines in the reels project (login.php, feed.php) that prevent this.