How Does WAF Detect SQL Injection, XSS, and PHP Injection Attacks?
A Structured Query Language (SQL) injection is a common web attack. The attacker injects malicious SQL commands into database query strings to deceive the server into executing commands. By exploiting these commands, the attacker can obtain sensitive information, add users, export files, or even gain the highest permissions to the database or system.
XSS attacks exploit vulnerabilities left during web page development to inject malicious instruction code into web pages so that attackers can trick visitors into loading and executing malicious web page programs attackers fabricated. These malicious web page programs are usually JavaScript, but they can also include Java, VBScript, ActiveX, Flash, or even common HTML. After an attack succeeds, the attacker may obtain various content, including but not limited to higher permissions (for example, permissions for certain operations), private content, sessions, and cookies.
How Does WAF Detect SQL Injection Attacks?
WAF detects and matches SQL keywords, special characters, operators, and comment symbols.
- SQL keywords: union, Select, from, as, asc, desc, order by, sort, and, or, load, delete, update, execute, count, top, between, declare, distinct, distinctrow, sleep, waitfor, delay, having, sysdate, when, dba_user, case, delay, and the like
- Special characters: ',; ()
- Mathematical operators: ±, *, /, %, and |
- Operators: =, >, <, >=, <=, !=, +=, and -=
- Comment symbols: – or /**/
How Does WAF Detect XSS Attacks?
WAF checks HTML script tags, event processors, script protocols, and styles to prevent malicious users from injecting malicious XSS statements through client requests.
- XSS keywords (such as javascript, script, object, style, iframe, body, input, form, onerror, and alert)
- Special characters (<, >, ', and ")
- External links (href="http://xxx/",src="http://xxx/attack.js")
![](https://support.huaweicloud.com/intl/en-us/waf_faq/public_sys-resources/note_3.0-en-us.png)
Rich text can be uploaded using multipart upload instead of body. In multipart upload, rich text is stored in forms and can be decoded even if it is encoded using Base64. Analyze your services and do not use quotation marks and angle brackets as far as possible.
How Does WAF Detect PHP Injection Attacks?
If a request contains keywords similar to "system(xx)", the keywords may cause PHP injection attacks. WAF will then block such requests.
About WAF FAQs
- FAQs
- Can WAF Protect an IP Address?
- What Objects Does WAF Protect?
- Does WAF Block Customized POST Requests?
- Does WAF Protect Traffic from Both IPv4 and IPv6 Addresses?
- What Are the Differences Between the Web Tamper Protection Functions of WAF and HSS?
- Which Web Service Framework Protocols Does WAF Support?
- Can WAF Protect Websites Accessed Through HSTS or NTLM Authentication?
- What Are the Differences Between WAF Forwarding and Nginx Forwarding?
- What Are the Differences Between WAF and CFW?
- Can I Configure Session Cookies in WAF?
- How Does WAF Detect SQL Injection, XSS, and PHP Injection Attacks?
- Can WAF Defend Against the Apache Struts2 Remote Code Execution Vulnerability (CVE-2021-31805)?
- Why Does the Vulnerability Scanning Tool Report Disabled Non-standard Ports for My WAF-Protected Website?
- What Are the Restrictions on Using WAF in Enterprise Projects?
- How Do I Obtain the Real IP Address of a Web Visitor?
- Will Traffic Be Permitted After WAF Is Switched to the Bypassed Mode?
- What Are Local File Inclusion and Remote File Inclusion?
- What Is the Difference Between QPS and the Number of Requests?
- Does WAF Support Custom Authorization Policies?
- How Do I Configure My Server to Allow Only Requests from WAF?
- Why Do Cookies Contain the HWWAFSESID or HWWAFSESTIME field?
- Can I Switch Between the WAF Cloud Mode and Dedicated Mode?
- Can I Add a Domain Name or IP Address to WAF Under Different Accounts?
- How Do I Configure WAF If a Reverse Proxy Server Is Deployed for My Website?
- How Does WAF Forward Access Requests When Both a Wildcard Domain Name and a Single Domain Name Are Connected to WAF?
- What Are Regions and AZs?
- Can I Use WAF Across Regions?
- In Which Regions Is WAF Available?
- Can I Use WAF Across Enterprise Projects?
- Can I Use a WAF Instance in a Specific Enterprise Project for Other Enterprise Projects?
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbotmore