SQL & NoSQL Injection

How injection works, blind variants and parameterised queries.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

10/10

1. 00:00SQL & NoSQL Injection. How injection works, blind variants and parameterised queries.
2. 00:05Injection occurs when user input is concatenated into a query so the data becomes part of the command.
3. 00:12The classic result is authentication bypass or full database dumping.
4. 00:17The bug (js): // VULNERABLE…
5. 00:22Error-based: the database error message leaks structure.
6. 00:27Union-based: append a UNION SELECT to read other tables.
7. 00:32Blind boolean: the page changes subtly with true/false conditions.
8. 00:37Time-based blind: use a sleep to infer answers from response delay.
9. 00:42NoSQL: operator injection such as sending an object instead of a string.
10. 00:47Note: Defence: always parameterise or use an ORM's binding, apply least-privilege database users, validate types, and never surface raw database errors to users.

Injection occurs when user input is concatenated into a query so the data becomes part of the command. The classic result is authentication bypass or full database dumping.

// VULNERABLE
const sql = "SELECT * FROM users WHERE email = '" + email + "'";
// email = "' OR '1'='1"  ->  the WHERE clause is always true

// SAFE - parameterised, input can never become syntax
db.query('SELECT * FROM users WHERE email = $1', [email]);

• Error-based: the database error message leaks structure.
• Union-based: append a UNION SELECT to read other tables.
• Blind boolean: the page changes subtly with true/false conditions.
• Time-based blind: use a sleep to infer answers from response delay.
• NoSQL: operator injection such as sending an object instead of a string.