SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 359
Oracle offers a detailed explanation on how to use dbms_assert in a tutorial on
defending against SQL injection attacks (http://st-curriculum.oracle.com/tutorial/
SQLInjection/index.htm). To avoid attacks via modified public synonyms you should
always call the package via its fully qualified name.
Encoding for Microsoft SQL Server
As SQL Server also uses the single quote as the terminator for a string literal, it is necessary to
encode the single quote when it is included in strings that will be included within dynamic
SQL. In SQL Server, you can achieve this by replacing the single quote with two single quotes.
This will cause the single quote to be treated as a part of the string literal, and not as a string
terminator, effectively preventing a malicious user from being able to exploit SQL injection on
that particular query. You can do this in C# via code that is similar to the following:
sql = sql.Replace("'", "''");
For example, the preceding code would cause the string O’Boyle to be quoted to the string
O’’Boyle. If stored to the database, it will be stored as O’Boyle but will not cause string termination
issues while being manipulated while quoted. You should be careful when doing a string
replacement in stored procedure Transact-SQL code, however. Because the single quote needs
to be quoted in Transact-SQL since it is a string terminator, you need to replace a single quote
with two single quotes in Transact-SQL via the slightly less straightforward replacement of one
quote (presented by two single quotes) with two quotes (represented by four quotes) as follows:
SET @enc = replace(@input, '''', '''''')
which may be more logical and clearer to represent as character codes:
SET @enc = replace(@input, CHAR(39), CHAR(39) + CHAR(39));
For other types of SQL functionality, it may also be necessary to quote information that
is submitted in dynamic SQL, namely where using wildcards in a LIKE clause. Depending
on the application logic in place, it may be possible for an attacker to subvert logic by
supplying wildcards in the input that is later used in the LIKE clause. In SQL Server,
the wildcards that are shown in Table 8.4 are valid in a LIKE clause.
Table 8.4 Microsoft SQL Server LIKE Wildcards
Character
Meaning
% Match zero or more of any character
_
Match exactly one of any character
[ ] Any single character within the specified range [a–d] or set [abcd]
[^]
Any single character not within the specified range [^a–d] or set
[^abcd]