SQL Injection Attacks and Defense - 2009

360 Chapter 8 • Code-Level Defenses
In instances where you need to use one of these characters in a LIKE clause within
dynamic SQL, you can quote the character with square brackets, []. Note that only the
percentage (%), underscore (_) and opening square bracket ([) characters will need to be
quoted; the closing square bracket (]), carat (^), and dash (-) characters have special meaning
only when they are preceded by an opening square bracket. You can do this as follows:
sql = sql.Replace("[", "[[]");
sql = sql.Replace("%", "[%]");
sql = sql.Replace("_", "[_]");
Additionally, to prevent a match on one of the preceding characters, you can also define
an escape character for the query, precede the wildcard character with the escape character,
and specify the escape character in the query using an ESCAPE clause. Here is an example:
SELECT * from users WHERE name LIKE 'a%'
-- Vulnerable. Returns all users starting with 'a'
SELECT * from users WHERE name LIKE 'a\%' ESCAPE '\'
-- Not vulnerable. Returns user 'a%', if one exists
Note that when using the ESCAPE clause, you can specify any single character to be
used as the escape character. I used the backslash in this example because this is a common
convention when escaping content.
Tip
When encoding single quotes as two single quotes in Transact-SQL (e.g., in a
stored procedure), be careful to allocate enough storage to the destination
string; generally twice the expected maximum size of the input plus one
should be sufficient. This is because Microsoft SQL Server will truncate the
value that is stored if it is too long, and this can lead to problems in dynamic
SQL at the database level. Depending on the query logic in place, this can
lead to an SQL injection vulnerability that is caused by the filtering you have
in place to prevent it.
For the same reason, it is recommended that you use replace( ) rather
than quotename( ) to perform encoding, as quotename() does not correctly
handle strings longer than 128 characters.
Encoding for MySQL
MySQL Server also uses the single quote as a terminator for a string literal, so it is necessary
to encode the single quote when it is included in strings that will be included within dynamic
SQL. In MySQL, you can do this either by replacing the single quote with two single quotes
as with other database systems, or by quoting the single quote with a backslash (\).