SQL Injection Attacks and Defense - 2009

Reviewing Code for SQL Injection • Chapter 3 111
You can use the following command to recursively search a directory of source files
for the use of odbc_prepare( ) and odbc_exec( ) with direct user input into an SQL statement.
The odbc_prepare( ) function is used prior to odbc_execute( ) to compile an SQL statement.
$ grep -r -n "\(odbc_prepare\|odbc_exec\)\(.*\$_\(GET\|\POST\).*\)" src/ |
awk -F : '{print "filename: "$1"\nline: "$2"\nmatch: "$3"\n\n"}'
filename: src/odbc_exec.vuln.php
line: 3
match: $result = odbc_exec ($con, "SELECT * FROM TABLE WHERE COLUMN =
'$_GET['var']'");
filename: src/odbc_prepare.vuln.php
line: 3
match: $result = odbc_prepare ($con, "SELECT * FROM TABLE WHERE COLUMN =
'$_GET['var']'");
You can use the following command to recursively search a directory of source files for
the use of mssql_bind( ) with direct user input into an SQL statement. This function is used
prior to mssql_execute( ) to compile an SQL statement.
$ grep -r -n "mssql_bind\(.*\$_\(GET\|\POST\).*\)" src/ | awk -F :
'{print "filename: "$1"\nline: "$2"\nmatch: "$3"\n\n"}'
filename: src/mssql_bind.vuln.php
line: 8
match: mssql_bind($sp, "@paramOne", $_GET['var_one'], SQLVARCHAR, false, false, 150);
filename: src/mssql_bind.vuln.php
line: 9
match: mssql_bind($sp, "@paramTwo", $_GET['var_two'], SQLVARCHAR, false, false, 50);
You can easily combine these grep one-liners into a simple shell script and trivially
modify the output so that the data can be presented in XML, HTML, CSV, and other
formats. You can use the string searches to find all of the low-hanging fruit, such as the
dynamic construction of parameters for input into stored procedures and SQL statements,
where the input is not validated and is input directly from GET or POST parameters.
The problem is that even though a lot of developers do not validate their input before using
it in dynamically created SQL statements, they first copy the input to a named variable.
For example, the following code would be vulnerable; however, our simple grep strings
would not identify lines of code such as these:
$sql = "SELECT * FROM TBL WHERE COLUMN = '$_GET['var']'"
$result = mysql_query($sql, $link);