SQL Injection Attacks and Defense - 2009

END;
Execute immediate 'SELECT count(*) FROM users where username=:1 and
password=:2' into result using username,password;
Validating Input
Code-Level Defenses • Chapter 8 349
In the previous section, we discussed avoiding the use of dynamic SQL to prevent SQL
injection. However, this should not be the only control you put in place to address SQL
injection. One of the most powerful controls you can use, if done well, is validation of the
input that an application receives.
Input validation is the process of testing input received by the application for compliance
against a standard defined within the application. It can be as simple as strictly typing a
parameter and as complex as using regular expressions or business logic to validate input.
There are two different types of input validation approaches: whitelist validation (sometimes
referred to as inclusion or positive validation) and blacklist validation (sometimes known as
exclusion or negative validation). These two approaches, and examples of validating input in
Java, C#, and PHP to prevent SQL injection, are detailed in the following subsections.
Tip
When performing input validation you should always ensure that the input
is in its canonical (simplest) form before making any input validation
decisions. This may involve decoding the input into a simpler format, or just
rejecting input that isn’t already in canonical format where non-canonical
input isn’t expected. We’ll cover canonicalization in a separate solution
later in this chapter.
Whitelisting
Whitelist validation is the practice of only accepting input that is known to be good.
This can involve validating compliance with the expected type, length or size, numeric range,
or other format standards before accepting the input for further processing. For example,
validating that an input value is a credit card number may involve validating that the input
value contains only numbers, is between 13 and 16 digits long, and passes the business logic
check of correctly passing the Luhn formula (the formula for calculating the validity of
a number based on the last “check” digit of the card).