Dreams will remain dreams until you stop dreaming and start working

SQL Injections-Unexpectedly Dangerous. What?How?

Posted on June 1st, 2008.

Not all the user inputs are safe. Some of the inputs can be very hazardous to your website because it can lead to SQL injections.
SQL injections are those scripts/queries formed by the concatenation of dynamic sql queries you write and the input users give.
lets take an example to be clear on it. Suppose you have written following scripts for your application:
Dim empID as String
Dim SqlQuery as String

empID = Request.QueryString(”emp_id”)
SqlQuery=”SELECT emp_Name FROM employee WHERE emp_id= ‘ ” + empID + “ ‘ “
Now, if user clicks or inputs something to get the name of enployee, then he will get it. Like he can input the emp_id as 5 . But there’s no guarantee that all users will input just a number or what the programmer expects them to input. Just think what happens if any user unintentionally or a hacker intentionally inputs this :’ 5 ; DROP TABLE employee —‘ . What this does is it terminates the current statement with semicolon ( ; ) i.e, it terminates SELECT emp_name FROM employee WHERE emp_id=5 . And then another statement starts i.e, DROP TABLE employee . After that the ‘ — ‘ at last comments out everything after that.
This creates an SQL injection and can leave u completely breathless. Not only dropping the tables but hackers can even perform a join and retrieve all your data.
Now lets move into the solution for SQL injection.
1. Don’t use dynamic SQL statements. Even if you want to use , then use only with type-safe parameter encoding. Like done below

Dim empID AS String
Dim cmd AS New SqlCommand
Dim param AS New SqlParameter
empID=Request.QueryString ( “emp_id”)
cmd= “SELECT emp_Name FROM employee WHERE emp_id= @ empID
param((“empID”, SqlDbType.VarChar)
cmd.Parameters.Add(param)

2. Use stored procedures always as far as possible.
Conduct Security Review.

Make a Comment

Make A Comment: ( 8 so far )

8 Responses to “SQL Injections-Unexpectedly Dangerous. What?How?”

Comments RSS Feed

Where's The Comment Form?