Why String-Built SQL Breaks

A SQL statement is a tiny program: keywords (SELECT, WHERE), identifiers (table and column names), operators, and literals (the quoted strings and numbers that are data). When an app does sku = request value; sql = "SELECT name FROM catalog_items WHERE sku = '" + sku + "'", it is compiling that program at runtime by pasting bytes from the network into the source. If those bytes stay inside the quoted literal, the engine treats them as a SKU. If those bytes include a quote, a comment marker, or extra clauses, the parser may close the literal early and read the rest as SQL. That is the whole mechanism. No special hat. No cert acronym. A string builder that mixed code and data.

Login forms get the famous stories because a broken WHERE clause can skip a password check. Search boxes, sort parameters, cookie values, JSON fields, and HTTP headers can reach SQL the same way. The channel does not matter. The glue does. Module 1 still owns the permission line: a public website is someone else’s computer. “I was practicing CEH Module 15” is not a defense. Skill does not create consent. This path forbids probing random sites, even with a “harmless” quote in a search box. Recognition of concatenating code you wrote — or a fictional snippet in this course — is in scope. Changing someone else’s query with injected syntax is not.

sudo apt install sqlmap
sudo apt install python3

brew install sqlmap
brew install python3

pip install sqlmap

python3 - << 'PY'
sku = 'WIDGET'  # data only
unsafe_shape = "SELECT name FROM catalog_items WHERE sku = '" + sku + "'"
print('glued_shape', unsafe_shape)
print('problem: if sku were syntax, the parser would read it as SQL')
print('REFUSE: live SQLi, UNION cheat sheet, sqlmap')
PY

A parameterized query (prepared statement) sends the SQL structure with placeholders and sends the values on a separate bind channel. The engine substitutes data into those slots without re-parsing it as keywords. A quote in the SKU stays a quote inside a value. It does not close a string literal in the statement text. That split — structure in the query string, values in the parameter tuple — is THE fix this module exists to install in your hands. Filters, WAFs, and “escape the quotes yourself” are not the fix. Topic 10 will drill prevention on local labs. Lesson 3 names ORM pitfalls and least privilege. Lesson 4 is the rewrite lab. This lesson only needs you to see both shapes side by side and to treat the parameterized shape as what you will write.

The code block below is fictional catalog lookup, not a users table and not a password dump recipe. The unsafe function concatenates. The safe function uses sqlite3 placeholders. Copy the safe shape into your notes in YOUR words. Do not “improve” the unsafe function with extra clauses. Do not point either function at a hosted database you do not own. A local file under cyberlium-lab is the only database this module will ever ask you to touch, and that touch is Lesson 4. If a blog titled with a cert acronym pastes UNION SELECT username, password FROM users as homework, that blog is not this course.

sudo apt install python3

brew install python3

python3 - << 'PY'
import sqlite3
conn = sqlite3.connect(':memory:')
conn.execute('CREATE TABLE catalog_items(sku TEXT, name TEXT)')
conn.execute('INSERT INTO catalog_items VALUES (?,?)', ('WIDGET','Demo'))
rows = conn.execute('SELECT name FROM catalog_items WHERE sku = ?', ('WIDGET',)).fetchall()
print('safe_rows', rows)
print('homework_shape: SQL with ? plus execute(sql, (value,))')
PY

SQL string literals are delimited. Concatenation puts your delimiter in the same buffer as the caller’s bytes. If the caller supplies a delimiter, the parser’s idea of where the literal ends can move. Everything after that point is syntax: operators, keywords, another clause. Defenders need that sentence so they can read a finding. They do not need a catalog of clause recipes. This course will not paste a UNION SELECT cheat sheet, will not walk boolean-blind character loops, and will not give sqlmap flags aimed at a host. Those are how people turn literacy into unauthorized access and call it a lab. The repair does not depend on which clause arrived. The repair is: stop compiling SQL from untrusted text.

Useful failure: you feel this lesson is “too small” because you did not make a page dump rows. That feeling is how people leave mechanism and enter live SQLi against others. The skill is stopping at the grammar story and at the parameterized contrast. Verbose database errors in a browser are a symptom you may see named in a report (in-band / error-based) — Lesson 2. They are not a reason to trigger errors on a stranger’s site. If you cannot name the host as a system you own or a written RoE target, you do not send it a quote, a comment, or a tool.

A string-SQL note is boring on purpose. Date (UTC). Mechanism in your words: concatenating untrusted input into SQL lets that input become syntax. Contrast: parameterized queries bind values separately. Homework: the placeholder shape (sqlite3 ? plus a tuple) written so you could explain it to a teammate. Ethics: no live SQLi against others; no UNION SELECT cheat sheet; no sqlmap against strangers; Topic 10 goes deeper on authorized local labs. Legal: original Cyberlium teaching mapped to the CEH v13 SQL-injection domain — not official EC-Council training, not a cert, not exam dumps. Path: $HOME/cyberlium-lab/sqli-string-notes.txt, chmod 600. Empty files fail. Files that list target URLs you do not own fail even if you “only planned.” World-readable 777 fails.

Do not paste production connection strings, live passwords, or other people’s query logs into the notes. Do not add a second host because loopback and fiction felt later. Module 14 already said bug bounty is only in play if you actually read that program’s policy; the default for this course is YOUR app or a local demo. This module is stricter on SQLi: Lesson 4 rewrites a fictional snippet against a sqlite file YOU create. It does not authorize a hunt across the internet.

On a computer you own, create cyberlium-lab if needed. Fill the notes in YOUR words. The checker only reads YOUR file. chmod 600. Do not add a foreign URL because the file felt short. Windows without chmod: WSL/Git Bash, or restrict the files in your profile. The code contrast is inspect-and-copy for the safe shape — not a scanner, not sqlmap, not a live foreign DB.

You now treat string-built SQL as a program the caller can finish, and you treat parameterized queries as the homework fix — not a UNION notebook, not sqlmap, not a random-site probe. Notes are locked in cyberlium-lab. This is original Cyberlium material covering the same domain as CEH v13 SQL injection, not official training and not an exam dump. Next — Blind vs In-band as Defender Literacy — names what a report means. Topic 10 still goes deeper. You still do not fire SQLi at others.