the-web-application-hackers-handbook

338 Chapter 9 n Attacking Data Stores
(continued)
Oracle: ORA-00900: invalid SQL statement
MS-SQL: Msg 170, Level 15, State 1, Line 1
Line 1: Incorrect syntax near foo
MySQL:
Translation:
You have an error in your SQL syntax. Check the
manual that corresponds to your MySQL server version
for the right syntax to use near XXXXXX
A general error message. The error messages listed previously all take
precedence, so something else went wrong. It’s likely you can try
alternative input and get a more meaningful message.
Oracle:
MS-SQL:
MySQL:
Translation:
ORA-03001: unimplemented feature
N/A
N/A
You have tried to perform an action that Oracle does not allow. This
can happen if you were trying to display the database version string
from v$version but you were in an UPDATE or INSERT query.
Oracle:
MS-SQL:
MySQL:
Translation:
ORA-02030: can only select from fixed tables/views
N/A
N/A
You were probably trying to edit a SYSTEM view. This can happen
if you were trying to display the database version string from
v$version but you were in an UPDATE or INSERT query.
Preventing SQL Injection
Despite all its different manifestations, and the complexities that can arise in its
exploitation, SQL injection is in general one of the easier vulnerabilities to prevent.
Nevertheless, discussion about SQL injection countermeasures is frequently misleading,
and many people rely on defensive measures that are only partially effective.
Partially Effective Measures
Because of the prominence of the single quotation mark in the standard explanations
of SQL injection flaws, a common approach to preventing attacks is to
escape any single quotation marks within user input by doubling them. You
have already seen two situations in which this approach fails:
n If numeric user-supplied data is being embedded into SQL queries, this
is not usually encapsulated within single quotation marks. Hence, an