SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 343
I should note, however, that parameterized statements are a method of supplying
potentially insecure parameters to the database, usually as a query or stored procedure call.
They do not alter the content of the values that are passed to the database, though, so if the
database functionality being called uses dynamic SQL within the stored procedure or
function implementation it is still possible for SQL injection to occur. This has historically
been a problem with Microsoft SQL Server and Oracle, both of which have shipped with
a number of built-in stored procedures that were vulnerable to SQL injection in the past,
and it is a danger that you should be aware of with any database stored procedures or
functions that use dynamic SQL in their implementation. An additional issue to consider
is that malicious content could have been stored in the database at this point that may then
be used elsewhere in the application, causing SQL injection at another point in the
application. We discussed this Chapter 7, in “Exploiting Second-Order SQL Injection.”
Here is an example of a vulnerable piece of login page pseudocode using dynamic
SQL. We will discuss how to parameterize this code in Java, C#, and PHP in the
following sections.
Username = request("username")
Password = request("password")
Sql = "SELECT * FROM users WHERE username='" + Username + "' AND password='"
+ Password + "'"
Result = Db.Execute(Sql)
If (Result) /* successful login */
Tools & Traps…
What Can Be Parameterized, and What Can’t?
Not all dynamic SQL statements can be parameterized. In particular, you can
parameterize only data values, and not SQL identifiers or keywords. Therefore, you
can’t have parameterized statements such as the following:
SELECT * FROM ? WHERE username = 'john'
SELECT ? FROM users WHERE username = 'john'
SELECT * FROM users WHERE username LIKE 'j%' ORDER BY ?
Continued