SQL Injection در MySQL — دور زدن احراز هویت

SQL Injection remains the most prevalent and dangerous web vulnerability, consistently ranking #1 or #3 in OWASP Top 10.

## Vulnerability Overview
SQL Injection occurs when user-supplied input is incorporated into database queries without proper sanitization or parameterization. An attacker can manipulate the query logic to bypass authentication, extract sensitive data, modify database contents, or execute OS commands.

## Technical Details
- **Vulnerable Component:** Any database-driven web application using dynamic query construction
- **Attack Vector:** Network (HTTP GET/POST parameters, headers, cookies)
- **Root Cause:** Concatenating user input directly into SQL queries without parameterized statements or prepared statements
- **Types:** Classic SQLi, Blind SQLi (Boolean/Time-based), Error-based, UNION-based, Out-of-band
- **Attack Complexity:** Low — automated tools like sqlmap can exploit in seconds

## Impact Assessment
- Authentication bypass (login without valid credentials)
- Full database dump including passwords, PII, financial data
- Data modification or deletion
- In some configurations: OS command execution via xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL)
- Lateral movement to internal systems

## Affected Versions
- Any application using unsanitized dynamic SQL queries
- PHP applications using mysql_query() (deprecated) or raw PDO without binding
- Laravel < 10.x with raw DB::select() calls

## Proof of Concept
Classic authentication bypass: `' OR '1'='1' -- `
UNION-based extraction: `' UNION SELECT username,password,3 FROM users -- `