Weaponizing Python with SQL Injection: A Rebel's Guide

Get ready to dive into the wild world of SQL injection, Python-style! In this guide, we're not taking the average route—we’re turning SQL vulnerabilities into a rebel's playground, mixing pure SQL voodoo with some Pythonic chaos. Ready to learn how everything could go wrong? You’re in for an exciting ride through 'sqlinj-ing' territory!

What is SQL Injection?

SQL injection (SQLi) is one of the most notorious database vulnerabilities where attackers can execute arbitrary SQL code on the backend. The reason for this vulnerability? Poorly constructed SQL queries that fail to sanitize user inputs. It's the OG of database security issues, known for its simplicity and devastating consequences.

In this guide, we're going to merge Python with SQL injection to unleash true chaos. But, before we go full rebel, let's break down how SQL injection works.

---

How SQL Injection Works

SQL injection happens when user input fields accept unsanitized data, allowing attackers to inject harmful SQL code. Here’s a basic SQL query:

SELECT * FROM users WHERE username = 'admin' AND password = 'password123';

Now, imagine you can hijack that query through user inputs. The code could look something like this:

SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1';

By injecting OR '1'='1', the query bypasses authentication and logs in as an admin. That’s the power of SQLi—simple yet deadly.

---

When Python and SQLi Collide

Many Python web frameworks, like Django and Flask, use Object-Relational Mapping (ORM) to handle database queries. ORMs provide an extra layer of security, but when you revert to raw SQL queries in your Python code, you’re essentially inviting SQL injection. Let’s see how.

Imagine a Python script using sqlite3:

import sqlite3

def get_user_info(username, password):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    cursor.execute(query)
    return cursor.fetchall()

On the surface, this seems harmless. But what happens if a hacker inputs:

• username = admin
• password = anything' OR '1'='1

The SQL query becomes:

SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1';

Boom! Instant bypass. The attacker is now logged in as an admin.

---

Next-Level Chaos: Python APIs with SQL Injection

APIs using Python often interact with databases through raw SQL queries, leaving them open to SQLi attacks. Imagine an API endpoint written in Flask:

@app.route('/user', methods=['GET'])
def user_info():
    username = request.args.get('username')
    password = request.args.get('password')

    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    cursor.execute(query)
    return cursor.fetchall()

A hacker could send:

• username = admin' --
• password = anything

The SQL query becomes:

SELECT * FROM users WHERE username = 'admin' --' AND password = 'anything';

The -- turns the rest of the query into a comment, bypassing password verification entirely.

---

Exploiting SQL Injection with Python Libraries

Libraries like sqlite3 or MySQLdb can become tools for SQL injection if user inputs aren't sanitized. Here’s an example using MySQLdb:

import MySQLdb

def get_user(username, password):
    db = MySQLdb.connect(host="localhost", user="root", passwd="root", db="testdb")
    cursor = db.cursor()
    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    cursor.execute(query)
    return cursor.fetchall()

If an attacker inputs:

• username = '; DROP TABLE users; --
• password = irrelevant

The SQL query becomes:

SELECT * FROM users WHERE username = ''; DROP TABLE users; --' AND password = 'irrelevant';

The DROP TABLE command deletes the entire users table. Goodbye, data!

---

Using ORM and SQLAlchemy: Are You Really Safe?

You might think using ORM (like SQLAlchemy) makes your app invulnerable, but even ORM can be exploited. Consider this example:

def get_user_raw(username, password):
    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    return db.session.execute(query).fetchall()

If raw SQL is used within ORM, it's still vulnerable to SQL injection. Inject malicious payloads, and the database becomes a playground.

---

How to Prevent SQL Injection in Python: A Rebel's Defense

While SQL injection is fun for testing, let’s talk defense. After all, you don't want to accidentally blow up your database. Here’s how to stay secure while maintaining your rebel coder status.

1. Use Prepared Statements (Parameterized Queries)

The golden rule for avoiding SQLi is using parameterized queries, which safely handle user input.

cursor.execute("SELECT * FROM users WHERE username = ? AND password = ?", (username, password))

2. Stick to ORM Queries

ORM frameworks handle SQL injection prevention for you, as long as you avoid raw SQL queries.

user = User.query.filter_by(username=username, password=password).first()

3. Validate and Sanitize User Input

Always sanitize user inputs before using them in SQL queries. Never trust user data, not even for a second.

4. Escape Special Characters

If you absolutely must use dynamic SQL, make sure to escape special characters properly. But seriously, avoid this if you can.

---

Final Thoughts: Rebel Coder with a Cause

SQL injection can turn any backend into a hacker's playground, but it can also be a tool for auditors and security experts to test vulnerabilities. With Python, the risk of SQLi grows when using raw SQL. The solution? Be smart, use parameterized queries, and always validate inputs.

With this knowledge, you can build stronger, more secure applications—or, if you’re feeling rebellious, find vulnerabilities in others' code. Stay safe, stay rebellious, and always code responsibly!