SQL Injection Attacks and Defense - 2009

Reviewing Code for SQL Injection • Chapter 3 99
To get started, the following lines build strings that are concatenated with tainted input
(data that has not been validated):
// a dynamically built sql string statement in PHP
$sql = "SELECT * FROM table WHERE field = '$_GET["input"]'";
// a dynamically built sql string statement in C#
String sql = "SELECT * FROM table WHERE field = '" +
request.getParameter("input") + "'";
// a dynamically built sql string statement in Java
String sql = "SELECT * FROM table WHERE field = '" +
request.getParameter("input") + "'";
The PHP, C#, and Java source code presented next shows how some developers
dynamically build and execute SQL statements that contain user-controlled data that has
not been validated. It is important that you are able to identify this coding behavior when
reviewing source code for vulnerabilities.
// a dynamically executed sql statement in PHP
mysql_query("SELECT * FROM table WHERE field = '$_GET["input"]'");
// a dynamically executed sql string statement in C#
SqlCommand command = new SqlCommand("SELECT * FROM table WHERE field = '" +
request.getParameter("input") + "'", connection);
// a dynamically executed sql string statement in Java
ResultSet rs = s.executeQuery("SELECT * FROM table WHERE field = '" +
request.getParameter("input") + "'");
Some developers believe that if they do not build and execute dynamic SQL statements
and instead only pass data to stored procedures as parameters, their code will not be
vulnerable. However, this is not true, as stored procedures can be vulnerable to SQL
injection also. A stored procedure is a set of SQL statements with an assigned name that’s
stored in a database. Here is an example of a vulnerable Microsoft SQL Server stored
procedure:
// vulnerable stored procedure in MS SQL
CREATE PROCEDURE SP_StoredProcedure @input varchar(400) = NULL AS
DECLARE @sql nvarchar(4000)
SELECT @sql = 'SELECT field FROM table WHERE field = ''' + @input + ''''
EXEC (@sql)
In the preceding example, the @input variable is taken directly from the user input
and concatenated with the SQL string (i.e., @sql ). The SQL string is passed to the EXEC
function as a parameter and is executed. The preceding Microsoft SQL Server stored
procedure is vulnerable to SQL injection even though the user input is being passed to it
as a parameter.