17. Why Learn All This Before Kali Linux?
17.5 From MySQL to SQL Injection
SQL injection (SQL इंजेक्शन) ajunahi web applications madhla sarvaat dhokadayak bug aahe. Part 5 madhe SELECT ... WHERE shiklat – aata tyach query cha gairvapar kasa hoto te samjel.
// VULNERABLE – user input glued into SQL text (never do this)
$sql = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'";
// input: ' OR '1'='1 → WHERE username = '' OR '1'='1' → every row matches!
// SAFE – prepared statement (what our reels project uses everywhere)
$stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE username = ?');
$stmt->execute([$_POST['username']]);
| You learnt (Part 5) | Attack side | Defence side |
|---|---|---|
WHERE, OR, comments (--) |
Classic ' OR '1'='1 login bypass |
Prepared statements |
UNION, SELECT columns |
UNION-based data extraction | Prepared statements, no verbose errors |
information_schema |
Enumerating tables and columns | Least-privilege DB user |
Users and GRANT |
Reading other databases, DROP TABLE |
App user with only needed privileges on one database |
| Safe update mode, backups | Destructive injected queries | Backups, monitoring, WAF as an extra layer |
Why this matters for security
sqlmap automates injection, but it cannot tell you why the bug exists or how to fix it. Because you know SQL and PDO, you can read the vulnerable line, prove it in DVWA (your lab only), and write the one-line fix – and explain why least privilege on RDS would have limited the damage anyway.
Ravindra Bagale's Tip
Khup students "input madhun quote ' kadhun taka" asa fix sangtat – to chukicha aahe, bypass hoto. Interview madhe ekach uttar dya: prepared statements (parameterised queries), tyasobat least-privilege DB user aani input validation. Ha prashna jawal jawal pratyek security interview madhe yeto, lakshat theva.
Practice task
Take the vulnerable line above and write, on paper, what the final SQL becomes for the inputs admin' -- and ' OR '1'='1. Then point to the exact lines in the reels project (login.php, feed.php) that prevent this.