Hacking and Comics

http://xkcd.com/ is a great fun site for geeks. Ok, that is not a very favorable label. Let's call them technological people. Artwork is not great, just stick figures, but sometimes there are some great jokes. You are a techie if you understand all. Dilbert of course is another well known tech comics, and Dilbert seems to focus on wackyness of people instead in recent years.

If you understand this comic: http://xkcd.com/327/, you know about a hacking technique known as SQL Injection!



This is a well known, simple to implement trick used by hackers.

We usually implement a search box by creating a SQL statement out of the search string entered by a user and then carry out the search and display result. One symbol to watch out for is the single quote, and the double dash. Single quote is for closing literals, and double slash is the start of comments. Every SQL programmers know that.

Check out the third box in the comics. The intended query may be

SELECT * FROM STUDENTS WHERE LASTNAME='Robert'

when the user enters "Robert" in the search box. Watch that single quote and double dash used together! The query becomes

SELECT * FROM STUDENTS  WHERE LASTNAME='Robert'; DROP TABLE Students;  --';

Whoa! The evil user sneaked in the DROP TABLE statement which wiped out the data! That double dash ignores the rest of the commands that can generate a syntax error.

Anti-Virus software and firewall do not totally prevent hackers.

What do you suggest to improve this code? (I have several suggestions, stay tuned)