Inserting data

Long ago, when the era of web applications backed by SQL databases started to bloom, some gutsy people invented the SQL injection attack. Here, a type of authentication is done against a database via SQL queries and, for example, after converting the password with mathematical magic into hash functions, the web app executes the query with the username and password coming from the input of the form. Many servers executed something like this:

"SELECT password FROM Auth WHERE username=<input from user>"

Then, the password gets rehashed; if the two hashes match, the password is good for the user.

The problem with this came from the <input from user> part because if the attacker was smart enough, they could reformulate the query and run additional commands. Here’s an example:

"SELECT password FROM Auth WHERE username=<input from user> OR '1'='1'"

The problem with this query is that OR '1&apos...