SQL

Structured Query Language (or SQL, pronounced as three separate letters, or "sequel" if you're an ESL) is a data-manipulating language for relational database management systems. It is used to define, query, update, and manage relational data. Many websites and imageboard engines such as Yotsuba rely on it. SQL is distinct from using ad-hoc string operations such as PHP's explode()/foreach()/implode() for data manipulation.

Simple tutorial[edit | edit source]

mysql> CREATE TABLE todos (
    ->   ID int AUTO_INCREMENT,
    ->   LABEL varchar(255),
    ->   PRIMARY KEY (ID)
    -> );

mysql> SELECT * FROM todos WHERE ID = 1;
+----+---------------+
| ID | LABEL         |
+----+---------------+
|  1 | Post on /soy/ |
+----+---------------+

Overview[edit | edit source]

There are many relational database systems that implement SQL, but for most website or imageboard projects the differences are minor. MySQL (and its fork MariaDB), PostgreSQL, SQLite, and Microsoft SQL Server are the most common. At the end of the day, it does not really matter which database system you pick as they all typically behave just about same and are partially interchangeable, so it's just about picking what works best for you.

• MySQL / MariaDB – Probably the most common known system. It is easy to set up and is widely supported. Basically the gold standard.
• PostgreSQL – More standards-compliant and feature-rich. Has support for "plugins" making it very flexible.
• SQLite – File-based database stored in a single .db file. It’s coal since it doesn’t handle high traffic very well because it writes everything to an single file. Good for testing or small projects though.
• Microsoft SQL Server – Microsoft’s database system. Has its own procedural language (T-SQL), lots of management/reporting tools, and heavy integration with Windows/.NET.
• MS Access ODBC – Is mainly used with Microsoft Windows + IIS + ASP servers from 1997.

There are different database access APIs as well, for writing database-agnostic code.

• ODBC (Open Database Connectivity) – a standard API for accessing databases. Any database management system that has an ODBC driver will support it. It is primarily for C, but you can get wrappers for it for C++ and Python.
• JDBC (Java Database Connectivity) – an API specifically for Java applications. Similar to ODBC.

SQL injection[edit | edit source]

	This is actually... LE HELPFUL? You can read this for more info about the topic

A SQL injection is a hacking technique to insert malicious SQL statements into an entry field to be executed.

Consider a simple PHP script that builds a query by concatenating a user-supplied ID:

$id = $_GET['id']; // attacker-controlled
$sql = "SELECT * FROM users WHERE id = '$id'"; 
$result = mysqli_query($conn, $sql);

An attacker can request ?id=1' OR '1'='1, then the SQL becomes:

SELECT * FROM users WHERE id = '1' OR '1'='1'

Similarly, one can bypass logins like so:

$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

If an attacker sets password to anything' OR '1'='1, the WHERE becomes always true, bypassing login.

If a website is shit enough, you could use this in raids. This has been done before on the sharty. If you don't want your site to get injected then use htmlspecialchars() or escapequotes() o algo

Example[edit | edit source]

Here are some examples.

[-+] Java

package party.soyjak.example;

import java.io.IOException;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
    String id = req.getParameter("id"); // attacker-controlled
    String st = String.format("SELECT * FROM users WHERE id = '%s'", id); // string concat -> SQLi
    try (Connection conn = dataSource.getConnection();
         Statement stmt = conn.createStatement();
         ResultSet rs = stmt.executeQuery(st)) {

        // ... process result ...
    } catch (SQLException e) {
        resp.sendError(500, "DB error");
    }
}

package party.soyjak.example;

import java.io.IOException;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.PreparedStatement;
import java.sql.SQLException;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
    String idParam = req.getParameter("id");
    // Validate/normalize if expecting an integer
    int id;
    try {
        id = Integer.parseInt(idParam);
    } catch (NumberFormatException ex) {
        resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid id");
        return;
    }

    String st = "SELECT id, username, email FROM users WHERE id = ?";
    try (Connection conn = dataSource.getConnection();
         PreparedStatement ps = conn.prepareStatement(st)) {
        ps.setInt(1, id);
        try (ResultSet rs = ps.executeQuery()) {
            if (rs.next()) {
                // handle row safely
            } else {
                resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
            }
        }
    } catch (SQLException e) {
        // log detail server-side, but don't leak SQL/errors to user
        logger.error("DB error", e);
        resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Server error");
    }
}

Thus, to prevent SQL injections:

• Use parametrized queries and prepared statements
• Validate input and whitelist specific values
• The DB user used by the app should only have necessary privileges (no DROP, etc.)
• Avoid verbose database errors to users: log errors safely and do not display raw SQL or stack traces
• Use ORMs carefully, watch raw queries
• Use DB-specific escaping only when parametrization can't be used
• Whitelist identifiers, map user choices to allowed names (do not accept arbitrary identifiers)
• Use web application firewalls and query-logging and alerts for suspicious patterns

SQL is part of a series on
Trolling and Raids
Visit the Soyfare portal for more.
Do we even know, who is this Snarky Snappy person or website?
Operations [-+] Christmas Campaign ♦ ColorBlox Raid ♦ Global War on Porn ♦ Goongate ♦ Great Cuckset ♦ Heyuri raid ♦ /mlpol/ Wars ♦ Operation 'Plier ♦ Operation 'za Month ♦ Operation 9/11 ♦ Operation Clog The Toilet ♦ Operation Chud Hansen ♦ Operation Deltarape ♦ Operation Footprint ♦ Operation Gemstro ♦ Operation Kikewaffen ♦ Operation Name the Party ♦ Operation No Nut November (Night of a Thousand 'zas ♦ Operation Total Femboy Death ♦ Operation Destroy Degenerates December ♦ Operation 404) ♦ Operation Pixel-ACK ♦ Operation Pokém-ACK! ♦ Operation Reality ♦ Operation Red Balloon ♦ Operation Slaughterhouse ♦ Operation Soyclipse ♦ Operation SoySphere-Cobvas ♦ Operation Soytanic ♦ Operation Total Vorefag Death ♦ Operation Wikisneedia ♦ Pedocaust (Operation Nigger Madness) ♦ Rapeson's Revenge ♦ R/Place Raids of 7/20/23 ♦ The Soyduel of St. Johns Bridge ♦ Soygate ♦ Times Square Takeover ♦ Tranny Soylita Raid ♦ UK police raids ♦ Undertroon Memories Rape ♦ Woman Raid ♦ World War Soy (Operation Soylent Brown)
Targets [-+] People/Groups: 4lung ♦ Adam Ragusea ♦ Ali Dawah ♦ Alyssa Mercante ♦ Bitch Productions ♦ Black Book Dox ♦ CeceFem ♦ ChibiReviews ♦ Evan Spencer Jacobs ♦ FallenChungus ♦ Feral27 ♦ Funamusea ♦ Fwucky ♦ GiantessElsie ♦ Giggly Goonclown ♦ Heghodge ♦ Illymations ♦ Jaiden animations ♦ Kirbizia ♦ LavenderCoffee ♦ Lee Goldson ♦ Lifeinmastermode ♦ Major Cloog ♦ MISTER MANTICORE ♦ Noah Samsen ♦ Minus8 ♦ Pawtzel ♦ Pizzacake ♦ Pyrocynical ♦ RacerNeem ♦ Rev says desu ♦ Sangria Snake ♦ Selphy6 ♦ Snitches ♦ Storster ♦ Svante Thunberg ♦ Swaglord ♦ The Incest Twins ♦ u/Eldergod74 ♦ Westthewerst Sites/Communities: 1chan ♦ 4chan (/ic/ - Artwork/Critique, /vp/ - Pokémon, /lgbt/ - Lesbian, Gay, Bisexual, & Transgender) ♦ 711chan ♦ 8chan ♦ Baraag.net ♦ Bluesky ♦ Bunkerchan ♦ Crystal Cafe ♦ The Cutting Room Floor ♦ E621.net ♦ ExplainXKCD ♦ Heyuri ♦ Kiwi Farms ♦ KnowYourMeme ♦ Lemmy ♦ Mlpol ♦ Moomoo.io ♦ Nairaland ♦ NoLimitsPedia ♦ PixelPlanet ♦ Reddit (R/196, R/ihaveihaveihavereddit, r/teachers, r/feedthememes) ♦ Skibidi Farms ♦ Snekmo ♦ Sturdychan ♦ Territorial.io ♦ The Amazing Digital Circus ♦ The Coffin of Andy and Leyley ♦ Wikipedia ♦ Wojak Paradise ♦ Yesmap Wiki ♦ Your World of Text ♦ Ytdraws.win
Techniques [-+] Bots ♦ Bait ♦ Ban evasion ♦ Catalog wiping ♦ Copypastas ♦ Datamining ♦ Derailing ♦ Dotspam ♦ Doxing (search.0t.rocks ♦ breach.vip) ♦ GETs ♦ Hacking ♦ Internet Trolling Tactics (/vp/) (/ic/) ♦ Leebait ♦ Linegemming ♦ Schizoposting ♦ Soydueling ♦ Soot Quest ♦ Spam ♦ Stealthjaks ♦ Vandalism though most devastatingly ♦ Semi Life Annoying Tatics
Types of raids [-+] Failraids ♦ Graffiti ♦ Habbo Raid ♦ Jackbox Raiding ♦ Long-term abuse ♦ Ss14 raiding ♦ Terraria Raiding ♦ Whiteboard raids
Trolling groups [-+] Anonymous ♦ CIA ♦ GNAA ♦ KKK ♦ Kiwi Farms ♦ NSS ♦ rDrama ♦ soyjak.party
V • T • E