SQL Injection Attacks and Defense - 2009

mssql_bind() − adds a parameter to a stored procedure
Reviewing Code for SQL Injection • Chapter 3 107
mssql_bind($stmt, '@param', $variable, SQLVARCHAR, false, false, 100);
$result = mssql_execute($stmt);
// odbc_prepare() − prepares a statement for execution
$stmt = odbc_prepare($db, $sql);
$result = odbc_execute($stmt);
// odbc_exec() − prepare and execute a SQL statement
$result = odbc_exec($db, $sql);
Things are a little different in Java. Java makes available the java.sql package and the Java
Database Connectivity ( JDBC) API for database connectivity; for details on supported
vendors, see http://java.sun.com/products/jdbc/driverdesc.html. We will concentrate on just
a few common database vendors for the purpose of clarity. The following list details the
relevant functions for MySQL, Microsoft SQL Server, and Oracle databases:
■■
createStatement( ) Creates a statement object for sending SQL statements to the
database
■ ■ prepareStatement( ) Creates a precompiled SQL statement and stores it in an object
■■
■■
■■
■■
■■
executeQuery( ) Executes the given SQL statement
executeUpdate( ) Executes the given SQL statement
execute( ) Executes the given SQL statement
addBatch( ) Adds the given SQL command to the current list of commands
executeBatch( ) Submits a batch of commands to the database for execution
The following lines of code demonstrate how you can use these functions in a
Java application:
// createStatement() − is used to create a statement object that is used for
// sending sql statements to the specified database
statement = connection.createStatement();
// PreparedStatement – creates a precompiled SQL statement and stores it
// in an object.
PreparedStatement sql = con.prepareStatement(sql);
// executeQuery() − sql query to retrieve values from the specified table.
result = statement.executeQuery(sql);
// executeUpdate () − Executes an SQL statement, which may be an
// INSERT, UPDATE, or DELETE statement or a statement that returns nothing
result = statement.executeUpdate(sql);
// execute() − sql query to retrieve values from the specified table.
result = statement.execute(sql);