SQL Injection Attacks and Defense - 2009

356 Chapter 8 • Code-Level Defenses
You can prevent this situation through the use of parameterized statements, as covered
earlier in this chapter. However, where it is not possible or desirable to use these, it will be
necessary to encode (or quote) the data sent to the database. This approach has a limitation,
in that it is necessary to encode values every time they are used in a database query; if one
encode is missed, the application may well be vulnerable to SQL injection.
Encoding for Oracle
As Oracle uses the single-quote character as the terminator for a string literal, it is necessary
to encode the single quote when it is included in strings that will be included within dynamic
SQL. In Oracle, you can do this by replacing the single quote with two single quotes.
This will cause the single quote to be treated as a part of the string literal, and not as a string
terminator, effectively preventing a malicious user from being able to exploit SQL injection
on that particular query. You can do this in Java via code that is similar to the following:
sql = sql.replace("'", "''");
For example, the preceding code would cause the string O’Boyle to be quoted to the
string O’’Boyle. If stored to the database, it will be stored as O’Boyle but will not cause string
termination issues while being manipulated while quoted. You should be careful when doing
a string replacement in PL/SQL code, however. Because the single quote needs to be quoted
in PL/SQL since it is a string terminator, you need to replace a single quote with two single
quotes in PL/SQL via the slightly less straightforward replacement of one quote (presented
by two single quotes) with two quotes (represented by four quotes) as follows:
sql = replace(sql, '''', '''''');
which may be more logical and clearer to represent as character codes:
sql = replace(sql, CHR(39), CHR(39) || CHR(39));
For other types of SQL functionality, it may also be necessary to quote information that
is submitted in dynamic SQL, namely where using wildcards in a LIKE clause. Depending
on the application logic in place, it may be possible for an attacker to modify how the
application logic works by utilizing wildcards in user input that is later used in a LIKE
clause. In Oracle, the wildcards in Table 8.2 are valid in a LIKE clause.
Table 8.2 Oracle LIKE Wildcards
Character
Meaning
% Match zero or more of any characters
_
Match exactly one of any character