0

The function is as following

ExecuteSQL('SELECT o.order_id,o.name,o.price from Orders as o where o.account_id = '+Request.parameter('account_id'));

The function is trying to extract the account_id from the url, what are some issues that can arise for this method? any better suggestions for getting account_id?

5
  • 4
    Please use only one tag for the database product you are really using. Jul 26 at 5:58
  • 3
    what are some issues that can arise for this method? SQL injection.
    – Akina
    Jul 26 at 6:03
  • 1
    Better suggestions include validating the request parameter value (e.g. numeric and within the expected range) along with a parameterized query. Your question about programming and better suited for stackoverflow.com.
    – Dan Guzman
    Jul 26 at 10:55
  • 1
    Duplicate on xkcd.
    – mustaccio
    Jul 26 at 11:43
  • Thank you guys for the valuable inputs
    – WebTech
    Jul 30 at 21:55

1 Answer 1

0

Concatenating parameter directly from url you can expose your database to sql injection.

If someone input this on accounrid:

&accountid=0;select*from+sys.tables

It can start dumping your tables.

In this casez if account is a number, you can validate if its value contains something different of numbers and returns errors if do.

Check this help from docs to more informations:

https://docs.microsoft.com/en-us/sql/relational-databases/security/sql-injection?view=sql-server-ver16

1
  • Thank you for this very helpful answer.
    – WebTech
    Jul 30 at 21:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.