sql injection

[PacketThirst]

Sql injection is a form of attack that makes use of poor input validation on a system to execute malicious sql statements on a database. The databases that you mentioned basically uses SQL. But, there are extensions specific to these databases that add programming functionality like T-SQL for MSsql and PL/SQL for Oracle .

There will be obviously be some variations in the attack depending on the database. For eg., Mqsql's mysql_query() function does not
permit query stacking unlike SQLite and PostgreSQL. So, In mysql you can't have an attack that makes use of a ";" to execute multiple queries.

A good tutorial on SQL Injection
http://www.acunetix.com/websitesecur...-injection.htm

SQL Injection tutorial on mssql
http://www.ngssoftware.com/papers/ad..._injection.pdf

SQL Injection tutorial on mysql
http://dev.mysql.com/tech-resources/...curity-ch3.pdf

SQL Injection tutorial on oracle
http://www.integrigy.com/security-re...on_Attacks.pdf

Illustrated SQL Injection
http://www.cert.org.in/knowledgebase...wp-2005-06.pdf

And the google queries I used to get them ;-)
"sql injection ", "sql injection filetype: pdf"

Read them all and try your sql injection skills here
http://hackme.ntobjectives.com/

have Fun :-D