SQL Injection Attacks and Defense - 2009

100 Chapter 3 • Reviewing Code for SQL Injection
The Microsoft SQL Server database is not the only database where stored procedures
can be vulnerable to SQL injection. Here is the source code for a vulnerable MySQL
stored procedure:
// vulnerable stored procedure in MySQL
CREATE PROCEDURE SP_ StoredProcedure (input varchar(400))
BEGIN
SET @param = input;
SET @sql = concat('SELECT field FROM table WHERE field=',@param);
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
End
In the preceding example, the input variable is taken directly from the user input and
concatenated with the SQL string (@sql ). The SQL string is passed to the EXECUTE
function as a parameter and is executed. The preceding MySQL stored procedure is
vulnerable to SQL injection even though the user input is passed to it as a parameter.
Just as with Microsoft SQL Server and MySQL databases, Oracle database stored
procedures can also be vulnerable to SQL injection. Here is the source code for a
vulnerable Oracle stored procedure:
-- vulnerable stored procedure in Oracle
CREATE OR REPLACE PROCEDURE SP_ StoredProcedure (input IN VARCHAR2) AS
sql VARCHAR2;
BEGIN
sql := 'SELECT field FROM table WHERE field = ''' || input || '''';
EXECUTE IMMEDIATE sql;
END;
In the preceding case, the input variable is taken directly from the user input and concatenated
with the SQL string (sql ). The SQL string is passed to the EXECUTE function as a
parameter and is executed. The preceding Oracle stored procedure is vulnerable to SQL
injection even though the user input is passed to it as a parameter.
Developers use slightly different methods for interacting with stored procedures.
The following lines of code are presented as examples of how some developers execute
stored procedures from within their code:
// a dynamically executed sql stored procedure in PHP
$result = mysql_query("select SP_StoredProcedure($_GET['input'])");
// a dynamically executed sql stored procedure in C#
SqlCommand cmd = new SqlCommand("SP_StoredProcedure", conn);
cmd.CommandType = CommandType.StoredProcedure;