Problem - Kevin Tafuro

Obviously, the best way to avoid SQLinjection attacks is to not create SQLcommand
strings that include any user input. In some small number of applications, this
may be feasible, but more frequently it is not. Avoid including user input in SQL
commands as much as you can, but where it cannot be avoided, you should escape
dangerous characters.
Discussion
SQLinjection attacks are really just general input validation problems. Unfortunately,
there is no perfect solution to preventing these types of attacks. Your best
defense is to apply strict checking of input—even going so far as to refuse questionable
input rather than attempt to escape it—and hope that that is a strong enough
defense.
There are two main approaches that can be taken to avoid SQL injection attacks:
Restrict user input to the smallest character set possible, and refuse any input that contains
character outside of that set.
In many cases, user input needs to be used in queries such as looking up a username
or a message number, or some other relatively simple piece of information.
It is rare to need any character in a user name other than the set of
alphanumeric characters. Similarly, message numbers or other similar identifiers
can safely be restricted to digits.
With SQL, problems start to occur when symbol characters that have special
meaning are allowed. Examples of such characters are quotes (both double and
single), semicolons, percent symbols, hyphens, and underscores. Avoid these
characters wherever possible; they are often unnecessary, and allowing them at
all just makes things more difficult for everyone except an attacker.
Escape characters that have special significant to SQL command processors.
In SQLparlance, anything that is not a keyword or an identifier is a literal. Keywords
are portions of a SQLcommand such as SELECT or WHERE, and an identifier
would typically be the name of a table or the name of a field. In some cases, SQL
syntax allows literals to appear without enclosing quotes, but as a general rule
you should always enclose literals with quotes.
Literals should always be enclosed in single quotes ('), but some SQLimplementations
allow you to use either single or double quotes ("). Whichever you
choose to use, always close the literal with the same character with which you
opened it.
Within literals, most characters are safe to leave unescaped, and in many cases,
it is not possible to escape them. Certainly, with whichever quoting character
you choose to use with your literals, you may need to allow that character inside
the literal. Escaping quotes is done by doubling up on the quote character. Other
characters that should always be escaped are control characters and the escape
character itself (a backslash).
108 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.