2019-08-19-Active Record and SQL Injection

Object-relational mapping - ORM

Yii offers different ways to work with your database programmatically, such as direct queries and a query builder, but using Active Record offers a complete set of benefits for object-oriented database programming.

Active Record provides an object-oriented solution for working with your database which is closely integrated with Yii models.

An Active Record class is associcated with a database table, an Active Record instance corresponds to a row of that table, and an attribute of an Active Record instance represents the value of a particular column in that row.

Instead of writing raw SQL statements, you would access Active Record attributes and call Active Record methods to access and manipulate the data stored in database tables.

---

SQL Injection

SQJ Injection Base on 1=1 is Always True

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;

UserInput:

UserId: 105 OR 1 = 1

SELECT * FROM Users WHERE UserId = 105 OR 1=1;

---

SQL Injection Based on ""="" is Always True

Here is an example of a user login on a web site:

UserInput#1

Username: John Doe
Password: myPass

uName = getRequestString("username");
uPass = getRequestString("userpassword");

sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"'

UserInput#2

Username:
" or ""="
Password:
"" or ""="

Result:

select * from Users where name ="" or ""="" and Pass = "" or ""=""

https://www.w3schools.com/sql/sql_injection.asp