SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 361
Either of these will cause the single quote to be treated as a part of the string literal,
and not as a string terminator, effectively preventing a malicious user from being able to
exploit SQL injection on that particular query. You can do this in Java via code that is similar
to the following:
sql = sql.replace("'", "\'");
Additionally, PHP provides the mysql_real_escape( ) function, which will automatically
quote the single quote with a backslash, as well as quoting other potentially harmful
characters such as 0x00 (NULL), newline (\n), carriage return (\r), double quotes (“),
backslash (\), and 0x1A (Ctrl+Z).
mysql_real_escape_string($user);
For example, the preceding code would cause the string O’Boyle to be quoted to the
string O\’Boyle. If stored to the database, it will be stored as O’Boyle but will not cause string
termination issues while being manipulated while quoted. You should be careful when doing
a string replacement in stored procedure code, however. Because the single quote needs to
be quoted since it is a string terminator, you need to replace a single quote with two single
quotes in stored procedure code via the slightly less straightforward replacement of one
quote (presented by a quoted single quote) with a quoted single quote (represented by
a quoted backslash and a quoted single quote) as follows:
SET @sql = REPLACE(@sql, '\'', '\\\'')
which may be more logical and clearer to represent as character codes:
SET @enc = REPLACE(@input, CHAR(39), CHAR(92, 39));
For other types of SQL functionality, it may also be necessary to quote information that
is submitted in dynamic SQL, namely where using wildcards in a LIKE clause. Depending
on the application logic in place, it may be possible for an attacker to subvert logic by
supplying wildcards in the input that is later used in the LIKE clause. In MySQL,
the wildcards in Table 8.5 are valid in a LIKE clause.
Table 8.5 MySQL LIKE Wildcards
Character
Meaning
% Match zero or more of any characters
_
Match exactly one of any character
To prevent a match on one of the characters shown in Table 8.5, you can escape the
wildcard character with the backslash character (\). Here’s how to do this in Java:
sql = sql.replace("%", "\%");
sql = sql.replace("_", "\_");