Thread by @NikkiSiapno

134 million credit cards were stolen from Heartland's payment systems.

The hackers used one technique — SQL injections.

Here's how it works:

SQL injection is a type of attack where the attacker runs damaging SQL commands by inserting malicious SQL code into a web application input field or URL.

For example, imagine a web app that returns all your information after logging in. That query may look like the following:

SELECT * FROM users
WHERE username = 'USER_INPUT';

If an attacker were to submit a malicious input, the query could change to the following:

SELECT * FROM users
WHERE username = '' OR '1'='1';

This query will return all users as '1'='1' will always return true.

You can protect your system from SQL injection by doing the following:

1. Use prepared statements or parameterized queries:

User input cannot be executed because prepared statements and parameterized queries ensure a distinct separation between user input and SQL code.

2. Validate and clean inputs:

Use expected formats and constraints to validate user input, and clean inputs to get rid of characters that may be interpreted as SQL code.

3. Follow the least privilege principle:

Limit the permissions for database accounts used by applications and services to only what is required for their functionality. This limits the system's vulnerability to SQL injection attacks.

Want more engineering insights like this?

Subscribe to our free newsletter for a weekly roundup of all our best content:

drp.li/PnqjS

If this thread was helpful to you:

1. Connect with me: linkedin.com/in/nicolesiapno for content like this

2. Follow linkedin.com/company/levelu… for quality Programming & Tech content

3. Like & Retweet the tweet below to share it with others👇

https://twitter.com/1511613750637318151/status/1653280917350240257