{"id":157,"date":"2015-09-15T10:54:37","date_gmt":"2015-09-15T10:54:37","guid":{"rendered":"https:\/\/dbadave.co.uk\/?p=157"},"modified":"2016-02-09T22:25:59","modified_gmt":"2016-02-09T22:25:59","slug":"sql-injection-tutorial","status":"publish","type":"post","link":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/","title":{"rendered":"SQL Injection Tutorial"},"content":{"rendered":"<h2><em><strong>What Is SQL Injection?<\/strong><\/em><\/h2>\n<p>SQL injection is a technique used by hackers to get access to your data.\u00a0 It basically involves hackers taking advantage of user inputs on web pages in order to execute SQL statements against your database.<\/p>\n<p>If the input isn&#8217;t validated properly, the hacker can enter carefully constructed data with the effect being that the SQL that&#8217;s executed against your database is altered to have unintended consequences (from your point of view; the consequences are obviously intended from the hacker&#8217;s perspective!). These consequences could be the hacker gaining access to your confidential data, your data being wiped, and so on.<\/p>\n<p>SQL injection attack is one of the most common types of internet hacks and so it&#8217;s important that it&#8217;s understood and tested for by developers and those responsible for security. This quick SQL injection tutorial is intended to give a brief and easy to understand overview of the issue.<\/p>\n<h2><em><strong>Types Of SQL Injection<\/strong><\/em><\/h2>\n<p>There are three general types of SQL injection attacks:<\/p>\n<ul>\n<li>Query changing and redirection where the data is returned directly to the web page &#8211; see the SQL injection example below. This is known as &#8220;In Band&#8221; SQL injection.<\/li>\n<li>So-called &#8220;Out of Band&#8221; SQL injection &#8211; this is where the data is retrieved through a different medium than the application. For example, if an administrator has configured a system to email them when certain events occur, then a hacker can use this email functionality to email themselves the data.<\/li>\n<li>Blind SQL injection &#8211;\u00a0in this case, the hacker effectively asks the database questions that have a true or false answer and deduces information based on how the application responds.<\/li>\n<\/ul>\n<h2><em><strong>SQL Injection Example<\/strong><\/em><\/h2>\n<p>As a SQL injection example, consider a web application login screen where the user is prompted to enter their username and password. The application will then build a SQL query using the entered data such as:<\/p>\n<p><em>select username, password from users where username = &#8220;&#8216;&#8221; + entered_username + &#8220;&#8216;&#8221; and password = &#8220;&#8216;&#8221; + entered_password + &#8220;&#8216;&#8221;;<\/em><\/p>\n<p>So the end result will be a query such as:<\/p>\n<p><em>select username, password from users where username =&#8217;Dave&#8217; and password = &#8216;DBADave&#8217;;<\/em><\/p>\n<p>Now if the application doesn&#8217;t do any validation of the data entered before building this SQL query, then the hacker could enter the following for the username and password:<\/p>\n<p><em>admin&#8217; or 1=1 &#8212;<\/em><\/p>\n<p>(It doesn&#8217;t display too well on the internet but the &#8212; part is actually two dashes, which is a comment in SQL syntax so you are effectively commenting out the rest of the SQL statement)<\/p>\n<p>This would then result in the SQL query looking like this:<\/p>\n<p><em>select username, password from users where username = &#8216;admin&#8217; or 1=1 &#8212; and password = &#8216;admin&#8217; or 1=1 &#8211;&#8216;;<\/em><\/p>\n<p>As the &#8220;1=1&#8221; part of the where clause is always true, this query will return all records from the users table.<\/p>\n<p>Of course it&#8217;s important to remember that a login screen isn&#8217;t the only part of an application that&#8217;s vulnerable. Any screen that allows user input and then builds a query string to query the database is potentially vulnerable to SQL injection.<\/p>\n<h2><em><strong>How To Prevent SQL Injection<\/strong><\/em><\/h2>\n<p>The first thing developers can do to help prevent SQL injection is to use prepared statements with parameterized queries. When you do this, the hacker is not able to execute any injected SQL as the literal value of the data they enter is passed as the parameter. In the above example, the application would look for a username of &#8220;<em><strong>admin<\/strong><\/em>\u00a0<em><strong>or 1=1 &#8212;<\/strong><\/em>&#8220;. Similarly, stored procedures can be used with the same result too. Note, that it&#8217;s not enough just to say you used stored procedures so your code is safe from SQL injection, <a href=\"http:\/\/publicvoidlife.blogspot.co.uk\/2012\/01\/stored-procedures-and-sql-injection.html\" target=\"_blank\">you still need to consider security<\/a>.<\/p>\n<p>The input data can also be validated before the SQL query is built. For example, if a date value is expected to be input, check that a valid date has indeed been entered.<\/p>\n<h2><em><strong>Testing If A Site Is Vulnerable To SQL Injection<\/strong><\/em><\/h2>\n<p>When testing if a site is vulnerable to SQL injection, you have to make a list of all possible input fields where the input data could potentially be used for an attack. This includes all hidden POST requests. Then each possibility needs to be individually tested.<\/p>\n<p>Areas that are potentially vulnerable include authentication forms such as login screens and any field where the user can enter data that will be used to query the database.<\/p>\n<p>When testing for vulnerability, the first test is normally to append a single quote (&#8216;) to the end of the input data. A semi-colon (;) can also be used as this will also invalidate any SQL that is passed to the database.<\/p>\n<p>What you are looking to see is if the application just constructs a query string using\u00a0the entered data without doing any validation, and without using prepared statements.\u00a0If the application returns an error or shows some other unexpected behaviour, then this means your site is vulnerable.<\/p>\n<p>Other data that can be used to test include comments, constructs such as AND and OR, and you can also test by entering a text string\u00a0into a field that is expecting a number. Again, if the application displays a SQL error then this means your data is being used directly in the query and your application is vulnerable to SQL injection.<\/p>\n<p>This is only a brief overview of the sort of testing you need to do (which is a lot!). Luckily there are tools available that can automate SQL injection testing for you. There are even online testing tools available, such as <a href=\"https:\/\/hackertarget.com\/sql-injection-test-online\/\" target=\"_blank\">this one<\/a>.<\/p>\n<h2><em><strong>Open Source SQL Injection Testing Tools<\/strong><\/em><\/h2>\n<p>Here&#8217;s a brief list of some of the available open source tools you can use for SQL injection testing:<\/p>\n<p><a href=\"https:\/\/github.com\/portcullislabs\/bsql-hacker\" target=\"_blank\">BSQL Hacker<\/a><br \/>\n<a href=\"http:\/\/sourceforge.net\/projects\/themole\/files\/\" target=\"_blank\">Mole<\/a><br \/>\n<a href=\"http:\/\/sourceforge.net\/projects\/safe3si\/\" target=\"_blank\">Safe3 SQL Injector<\/a><br \/>\n<a href=\"https:\/\/github.com\/sqlmapproject\/sqlmap\" target=\"_blank\">SQLmap<\/a><br \/>\n<a href=\"http:\/\/sqlninja.sourceforge.net\/\" target=\"_blank\">SQLninja<\/a><br \/>\n<a href=\"http:\/\/sqlsus.sourceforge.net\/\" target=\"_blank\">SQLSus<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What Is SQL Injection? SQL injection is a technique used by hackers to get access to your data.\u00a0 It basically involves hackers taking advantage of user inputs on web pages in order to execute SQL statements against your database. If the input isn&#8217;t validated properly, the hacker can enter carefully constructed data with the effect &#8230; <a title=\"SQL Injection Tutorial\" class=\"read-more\" href=\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\" aria-label=\"Read more about SQL Injection Tutorial\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":363,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>SQL Injection Tutorial<\/title>\n<meta name=\"description\" content=\"An quick and easy-to-understand overview of SQL injection - what it is, types of SQL injection, how to prevent it &amp; how to test for vulnerability. READ MORE\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SQL Injection Tutorial\" \/>\n<meta property=\"og:description\" content=\"An quick and easy-to-understand overview of SQL injection - what it is, types of SQL injection, how to prevent it &amp; how to test for vulnerability. READ MORE\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\" \/>\n<meta property=\"og:site_name\" content=\"DBA Dave - Oracle Training\" \/>\n<meta property=\"article:published_time\" content=\"2015-09-15T10:54:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2016-02-09T22:25:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"340\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/dbadave.co.uk\/#\/schema\/person\/c51b3c9b3e2e2e9bbd141a719c024c40\"},\"headline\":\"SQL Injection Tutorial\",\"datePublished\":\"2015-09-15T10:54:37+00:00\",\"dateModified\":\"2016-02-09T22:25:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\"},\"wordCount\":963,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/dbadave.co.uk\/#organization\"},\"image\":{\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg\",\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\",\"url\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\",\"name\":\"SQL Injection Tutorial\",\"isPartOf\":{\"@id\":\"https:\/\/dbadave.co.uk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg\",\"datePublished\":\"2015-09-15T10:54:37+00:00\",\"dateModified\":\"2016-02-09T22:25:59+00:00\",\"description\":\"An quick and easy-to-understand overview of SQL injection - what it is, types of SQL injection, how to prevent it & how to test for vulnerability. READ MORE\",\"breadcrumb\":{\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage\",\"url\":\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg\",\"contentUrl\":\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg\",\"width\":770,\"height\":340,\"caption\":\"Sql Injection Tutorial\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/dbadave.co.uk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SQL Injection Tutorial\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/dbadave.co.uk\/#website\",\"url\":\"https:\/\/dbadave.co.uk\/\",\"name\":\"DBA Dave - Oracle Training\",\"description\":\"Expert DBA Tips &amp; Advice\",\"publisher\":{\"@id\":\"https:\/\/dbadave.co.uk\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/dbadave.co.uk\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/dbadave.co.uk\/#organization\",\"name\":\"DBA Dave\",\"url\":\"https:\/\/dbadave.co.uk\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/dbadave.co.uk\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2016\/02\/dba-dave-logo.png\",\"contentUrl\":\"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2016\/02\/dba-dave-logo.png\",\"width\":170,\"height\":50,\"caption\":\"DBA Dave\"},\"image\":{\"@id\":\"https:\/\/dbadave.co.uk\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/dbadave.co.uk\/#\/schema\/person\/c51b3c9b3e2e2e9bbd141a719c024c40\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/dbadave.co.uk\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3d6ad3f291a149878281854f13654bf0?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3d6ad3f291a149878281854f13654bf0?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"url\":\"https:\/\/dbadave.co.uk\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SQL Injection Tutorial","description":"An quick and easy-to-understand overview of SQL injection - what it is, types of SQL injection, how to prevent it & how to test for vulnerability. READ MORE","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/","og_locale":"en_US","og_type":"article","og_title":"SQL Injection Tutorial","og_description":"An quick and easy-to-understand overview of SQL injection - what it is, types of SQL injection, how to prevent it & how to test for vulnerability. READ MORE","og_url":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/","og_site_name":"DBA Dave - Oracle Training","article_published_time":"2015-09-15T10:54:37+00:00","article_modified_time":"2016-02-09T22:25:59+00:00","og_image":[{"width":770,"height":340,"url":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg","type":"image\/jpeg"}],"author":"admin","twitter_misc":{"Written by":"admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#article","isPartOf":{"@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/"},"author":{"name":"admin","@id":"https:\/\/dbadave.co.uk\/#\/schema\/person\/c51b3c9b3e2e2e9bbd141a719c024c40"},"headline":"SQL Injection Tutorial","datePublished":"2015-09-15T10:54:37+00:00","dateModified":"2016-02-09T22:25:59+00:00","mainEntityOfPage":{"@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/"},"wordCount":963,"commentCount":0,"publisher":{"@id":"https:\/\/dbadave.co.uk\/#organization"},"image":{"@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage"},"thumbnailUrl":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg","articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/","url":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/","name":"SQL Injection Tutorial","isPartOf":{"@id":"https:\/\/dbadave.co.uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage"},"image":{"@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage"},"thumbnailUrl":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg","datePublished":"2015-09-15T10:54:37+00:00","dateModified":"2016-02-09T22:25:59+00:00","description":"An quick and easy-to-understand overview of SQL injection - what it is, types of SQL injection, how to prevent it & how to test for vulnerability. READ MORE","breadcrumb":{"@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dbadave.co.uk\/sql-injection-tutorial\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#primaryimage","url":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg","contentUrl":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2015\/09\/sql-injection-tutorial-1.jpg","width":770,"height":340,"caption":"Sql Injection Tutorial"},{"@type":"BreadcrumbList","@id":"https:\/\/dbadave.co.uk\/sql-injection-tutorial\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dbadave.co.uk\/"},{"@type":"ListItem","position":2,"name":"SQL Injection Tutorial"}]},{"@type":"WebSite","@id":"https:\/\/dbadave.co.uk\/#website","url":"https:\/\/dbadave.co.uk\/","name":"DBA Dave - Oracle Training","description":"Expert DBA Tips &amp; Advice","publisher":{"@id":"https:\/\/dbadave.co.uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dbadave.co.uk\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/dbadave.co.uk\/#organization","name":"DBA Dave","url":"https:\/\/dbadave.co.uk\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dbadave.co.uk\/#\/schema\/logo\/image\/","url":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2016\/02\/dba-dave-logo.png","contentUrl":"https:\/\/dbadave.co.uk\/wp-content\/uploads\/2016\/02\/dba-dave-logo.png","width":170,"height":50,"caption":"DBA Dave"},"image":{"@id":"https:\/\/dbadave.co.uk\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/dbadave.co.uk\/#\/schema\/person\/c51b3c9b3e2e2e9bbd141a719c024c40","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dbadave.co.uk\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3d6ad3f291a149878281854f13654bf0?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3d6ad3f291a149878281854f13654bf0?s=96&d=mm&r=g","caption":"admin"},"url":"https:\/\/dbadave.co.uk\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/posts\/157"}],"collection":[{"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/comments?post=157"}],"version-history":[{"count":22,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/posts\/157\/revisions"}],"predecessor-version":[{"id":365,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/posts\/157\/revisions\/365"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/media\/363"}],"wp:attachment":[{"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/media?parent=157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/categories?post=157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dbadave.co.uk\/wp-json\/wp\/v2\/tags?post=157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}