How Safe is Your Website? – Part 2

Login credentials for computers

In this second part of “How Safe Is Your Website?”, we wanted to add one more attack variation that we think you should know about. The really popular way for hackers to access your website is through an attack called an SQL Injection. Here is a short post about SQL Injections and why they can be dangerous.

What is an SQL Injection?

SQL Injections are a tricky situation. SQL Injections involves the process of inserting SQL queries into a login form of a client login screen. In simpler terms, whenever you login to a website where you created an account, you need to always input your login name and password. This is required for private data websites, such as banking, email, student information, etc. websites. Whenever you type in your login and subsequent password, your credentials are then communicated to the server to then authenticate. Once the server pings back and grants access, then you are allow to enter the website. What SQL injectors do is essentially poison the login form of a website, so that whenever you try to login, they can steal all of your login credentials. This can be disastrous if it gets in the hands of the wrong people. Hackers can easily gather this information and sell it to third parties and come away with their hands clean of the mess.

Typically, simple and basic website security features have a difficult time filtering out SQL Injection attempts. According to Acunetix, they state, “since your website is public, security mechanisms will allow public web traffic to communicate with your web application(s).” This feature essentially gives a hacker full access to disrupt the channel of communication on the login page and the database, which it then can tap into.

We highly suggest reading about some tips to keep you ahead of the curve. One good resource is an article by eSecurity Planet about How to Prevent SQL Injection Attacks. This should provide a good analysis of what measures need to be implemented in order to make sure SQL Injections never happen to you. Happy cyber surfing!