SQL Injection Attacks and Defense - 2009

106 Chapter 3 • Reviewing Code for SQL Injection
be sufficient to help you understand how developers produce code that is vulnerable to SQL
injection. However, the examples were not extensive; each programming language offers a
number of different ways to construct and execute SQL statements, and you need to be
familiar with all of them. This section of the chapter presents a detailed list of these methods,
along with examples of how they are used. We will start with the PHP scripting language.
PHP supports numerous database vendors; visit http://www.php.net/manual/en/refs.
database.vendors.php for a comprehensive list. We will concentrate on just a few common
database vendors for the purpose of clarity. The following list details the relevant functions
for MySQL, Microsoft SQL Server, and Oracle databases:
■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
mssql_query( ) Sends a query to the currently active database
mysql_query( ) Sends a query to the currently active database
mysql_db_query( ) Selects a database, and executes a query on it (depreciated in
PHP Version 4.0.6)
oci_parse( ) Parses a statement before it is executed (prior to oci_execute()/ociexecute())
ora_parse( ) Parses a statement before it is executed (prior to ora_exec())
mssql_bind( ) Adds a parameter to a stored procedure (prior to mssql_execute())
mssql_execute( ) Executes a stored procedure
odbc_prepare( ) Prepares a statement for execution (prior to odbc_execute())
odbc_execute( ) Executes an SQL statement
odbc_exec( ) Prepares and executes an SQL statement
The following lines of code demonstrate how you can use these functions in a PHP
application:
// mssql_query() − sends a query to the currently active database
$result = mssql_query($sql);
// mysql_query() − sends a query to the currently active database
$result = mysql_query($sql);
// mysql_db_query() − selects a database, and executes a query on it
$result = mysql_db_query($db, $sql);
// oci_parse() − parses a statement before it is executed
$stmt = oci_parse($connection, $sql);
ociexecute($stmt);
// ora_parse() − parses a statement before it is executed
if (!ora_parse($cursor, $sql)){exit;}
else {ora_exec($cursor);}