SQL Injection Attacks and Defense - 2009

358 Chapter 8 • Code-Level Defenses
You can use the preceding functions as shown in the following examples. The first
code snippet is an insecure query without dbms_assert (SQL injection in FIELD, OWNER,
and TABLE):
execute immediate 'select '|| FIELD ||'
from'|| OWNER ||'.'|| TABLE;
Here is the same query, with input validation using dbms_assert:
execute immediate 'select '||sys.dbms_assert.SIMPLE_SQL_NAME(FIELD) ||'
from'||sys.dbms_assert.ENQUOTE_NAME
(sys.dbms_assert.SCHEMA_NAME(OWNER),FALSE)
||'.'||sys.dbms_assert.QUALIFIED_SQL_NAME(TABLE);
Table 8.3 lists the various functions supported by dbms_assert.
Table 8.3 dbms_assert Functions
Function
DBMS_ASSERT.SCHEMA_NAME
DBMS_ASSERT.SIMPLE_SQL_NAME
DBMS_ASSERT.SQL_OBJECT_NAME
DBMS_ASSERT.SIMPLE_SQL_NAME
DBMS_ASSERT.QUALIFIED_SQL_NAME
DBMS_ASSERT.ENQUOTE_LITERAL
DBMS_ASSERT.ENQUOTE_NAME
Description
This function checks to see whether the passed
string is an existing object in the database
This function checks that characters in an SQL
element consist only of A–Z, a–z, 0–9, $, #, and _.
If the parameter is quoted with double quotes,
everything with the exception of double quotes
is allowed
This function checks to see whether the passed
string is an existing object in the database
This function checks that characters in an SQL
element consist only of A–Z, a–z, 0–9, $, #, and _.
If the parameter is quoted with double quotes,
everything with the exception of double quotes
is allowed
This function is very similar to the SIMPLE_SQL_
NAME function but also allows database links
This function quotes the passed argument in
double quotes. If the argument was already
quoted, nothing will be done
This function encloses the user-supplied string in
single quotes if it has not already been done