Input Validation

Why Input Validation Matters

If we have an application that users are accessing on the web and it has some forms that they can fill out, this has been known as being a huge vector for problems. That is, they are able to manipulate and control these inputs into the system to gain access to information that they shouldn't have access to. And one way that we get rid of this is through input validation. It's a critical part when we're creating applications, to go through some sort of validation of any inputs.

Web Applications, Databases and SQL

I would say in the majority of cases, web applications have some sort of inputs to them and some sort of database on the back end. This is a very common setup, where you have a web server on the front end and a database on the back end. Many times they're two different servers that are operating these, and sometimes they're the same server that's operating these.

An example of this is if you've got users logging into your system — well, that information needs to be stored. If we're making calls to a database, somehow we need to be able to grab information and bring it into the servers. And one of the ways that we do that is through structured query language, or SQL. SQL works with a lot of different databases that are out there, and it's a way to form requests. Maybe it's requests to request information, or to add information, or to delete information, or to change information. But whatever the case may be, there is information that we enter into this.

In this example right here, we're trying to match up and find a username and password and do some sort of authentication. So somebody will input into the system here a username and password, and then we need to verify that through a command such as this right here.

SQL commands have some sort of syntax to them, a way that they're structured in how they're entered. So this server right here is making a call in a certain way. Here the commands right here — the select, the from, the where — are certain commands that are being entered in here. What are we selecting? All of the records, and for the table users. And then we're looking at the columns username and password, and then the inputs are taken from the web server. So essentially the web server has these fields, the users are entering them in there, which get logged in right here on the username and password, and then those are being matched up against the database.

So what is this? This is a way of authenticating. It's taking the username and password and authenticating against this database. So here's an example where the username is John Connor with "Skynet sucks." So this is the one that's being typed in here on the web, just as in our example right here. Somebody's typing this in, and then it's measuring against this SQL database to see if they should be allowed to log in or not.

The SQL Injection Attack

So let's take a look at a SQL injection attack. Here what we have is they're entering their username and password. It goes against the web server, and then that command gets submitted into the SQL database.

So what is this input injection attack? Well, let's put in something that looks a little different right here. So this gets submitted into the username and password fields that we saw before. What happens when we replace those username and password fields with this little command right here that we've entered in here? Now it looks like this. So now it's looking for a username of null essentially, or 1 equals 1, and a password of null or 1 equals 1. Well, what does 1 equal 1? It's true. So in this case right here, what responds back from the database is that this is a true statement. This is essentially allowing whoever is typing these commands into here to authenticate, to log in. Now they're authenticated with the system.

So by entering commands in these fields right here, it gets entered into these fields, and by doing this they can circumvent a proper username and password and instead use these fake commands, really is what it is. They're putting commands in there that equal true. There's lots of different commands that they can enter. They can do the commands to add, modify, delete, extract — they can enter in all of these commands into these fields. So this is a SQL injection attack. But there are other types of injection attacks as well. Lots of different types of injection attacks.

Validation Rules

So we need to guard against this injection attack. The way we guard against it is called input validation: to validate this input and make sure that they're not entering code into it.

So what does this mean? This means that we are going to have some sort of validation rules on it. And some examples of this: maybe we do the data type checks. So in this username and password, maybe we just allow letters, or maybe letters and numbers, or maybe special characters. What is it that we are going to allow with that? If we do have just numbers, maybe there's some sort of range that we allow with it. Or maybe it's some sort of specific thing, maybe a phone number or social security number, then there's some sort of format that we can accept and nothing outside that format is acceptable. Maybe it's the length of it — phone numbers are a certain length, so we don't allow larger than a regular phone number would be. Maybe we have certain required fields that must be filled in. Maybe there's some sort of uniqueness check, so that it prevents duplicate records, so when they're entering it in they're not going to create a whole other record. Maybe there's some sort of consistency check, like shipping date is not before the order date. They need to order it and then it gets shipped out; if they ship it first and then the order goes through, maybe they cancel it between those two and then they never get charged. And then also code check, so nothing resembling code can go into these inputs on the system.

What That Looks Like on a Form

So here's what it ends up looking like. First of all, we've got the required fields that must be entered here. And then when they enter it in, each one of these has a separate set of validation rules of the size, type, format, ranges, any kind of digits that they're going to check. So maybe in the first name, this is going to allow 10 characters. And the last name maybe is going to be 12 characters. And these are only letters that they're going to allow — they're not going to allow any numbers. And the address allows numbers and letters, but no special characters. The city is only going to be letters here, and only a certain amount. The state, maybe it's just two letters that's going to be for that. And so by specifying this, somebody can't enter in that code that we were looking at, and so they're not going to be allowed to enter something like that in and circumvent the security of this application.