Questions tagged [sql-injection]
For questions about SQL injection vulnerabilities.
72 questions
0
votes
2
answers
78
views
Can This Code Be Exploited for SQL Injection with Significant Impact?
I’m currently debating with a colleague whether the following (pseudo) code is vulnerable to SQL injection (SQL Server):
database.BeginTransaction();
String userId = dto.UserId;
String firstQuery = &...
- 1
0
votes
1
answer
112
views
Is it really possible to use SQL injection to change a database, or is this a scam?
A guy I know at college is claiming he can change his grades by gaining access to the database through an SQL inject, and can also gain access to all admin account privileges and records. The portal ...
- 11
1
vote
1
answer
150
views
What type of queries are considered as SQL injection?
I was testing efficacy of a paid Database security solution which has the ability to detect and block SQLi attack. For the testing purpose I have tried the following query against a PostgreSQL ...
- 393
0
votes
1
answer
354
views
MariaDB - SQL Injection on insert
There is a table name queries in my dummy database which has name, email, phone, message, and region. And there is a contact form in the UI which directly inserts the data into the queries table ...
- 103
10
votes
6
answers
3k
views
Is this SQL Procedure "injection proof"?
Most all answers and examples of SQL injection are showing some form of dynamic SQL or interpreting parameters as SQL.
I haven't been able to find an example of the "correct" way. Microsoft ...
- 271
1
vote
1
answer
132
views
Why is to_char used when doing a divide by 0 in Oracle based SQLi?
For conditional-error-based SQLi, instead of writing 1/0 directly like MYSQL, we need to write to_char(1/0) for Oracle, what is the reason behind this? Example,
Oracle:
SELECT CASE WHEN (YOUR-...
- 11
0
votes
2
answers
394
views
I'm trying to make an SQL injection in my own function in PostgreSQL 13
Just for learning purposes, I'm trying to create a function using PLPGSQL and make an SQL injection on it. I recently learned about format, USING and quote_literal and quote_indent, so I'm good about ...
- 136
0
votes
1
answer
1k
views
Allow create table (dynamic name) and insert but nothing else
I'm trying to find a way to allow an application to create tables and insert data into them on a SQL Server 2019 while protecting from injection attacks in case the app credentials would leak. My ...
- 196
0
votes
1
answer
42
views
Second Subquery Inside INSERT Into saves int 0
Read it carefully, we have this query which is inserting values in the table called users. For the value member_id we are running a subquery to select from the table admin_users the id of the member. ...
8
votes
3
answers
4k
views
How does use of sp_executesql with parameters protect against SQL injection?
The following is a dynamic filtering solution that uses sp_executesql
IF OBJECT_ID(N'dbo.GetOrders', N'P') IS NOT NULL DROP PROC dbo.GetOrders;
GO
CREATE PROC dbo.GetOrders
@orderid AS INT = NULL,
@...
- 319
3
votes
1
answer
13k
views
How to pass parameters to sql script via psql \i command
The psql \i command is able to execute a given SQL script but I need a way to pass parameters to the script.
Example: say you have this simple script
select * from :table LIMIT 1;
I've tried
my_db=&...
- 133
0
votes
1
answer
77
views
Is there any builtin mechanism to stop sql injections in mariadb?
Actually this question is a assignment given to me and I was not able to find any answer by googling. Is there any builtin mechanism in mariadb to stop sql injections?
0
votes
2
answers
959
views
Passing parameters in MySql procedure with prepare execute
I am trying to write a procedure that has a location parameter, this parameter is later used in the queries inside the procedure. Also, I want to be able to limit the query results dynamically.
I have ...
- 1
1
vote
2
answers
91
views
Inject aggregation function inside a procedure
Is it possible to inject the name of a function (AVG, MAX...) as a procedure parameter?
CREATE PROCEDURE test(func TEXT)
LANGUAGE PLPGSQL
AS $$
BEGIN
DROP TABLE IF EXISTS foo;
CREATE TEMPORARY TABLE ...
- 25
-1
votes
2
answers
511
views
TSQL - Sql Injection
DECLARE @TSQL NVARCHAR(MAX) = N'SELECT 1, ''One''';
CREATE TABLE #ThisIsATable (Id INT, VAL NVARCHAR(10));
INSERT INTO #ThisIsATable
EXEC [dbo].[sp_executesql] @TSQL ;
Is it safe to have input ...
- 109
0
votes
1
answer
80
views
Is this SP safe to SQL Injection?
CREATE PROCEDURE [sp_Test] (
@param nvarchar(Max)
) AS BEGIN
DECLARE @Output nvarchar(Max) =
N’Select ‘ + @param
Select @output
Return
Intended Use
exec sp_test ‘5’
Returns “select 5”
...
- 11
2
votes
2
answers
781
views
Divide by zero in ORDER BY CLAUSE
I just got a PEN-Test result from a web application. The tester stated they were able to use the ORDER BY clause of a dynamic SQL statement to retrieve information.
The name of the column that should ...
- 217
0
votes
1
answer
511
views
How to prevent a highly dynamic PL-SQL query from injection using bind variables
I have a procedure as you can see below:
create or replace procedure Injection_test(qry1 varchar2,
qry2 varchar2,
...
- 1,486
0
votes
0
answers
86
views
If there is no end-user input, is it safe to un-parameterize a parameterized query to avoid parameter sniffing?
AFAIK, a parameterized query is commonly used to prevent SQL injection attacks. What if there is no end-user input that can cause SQL injection? In this case, is it safe to un-parameterize a ...
- 539
1
vote
1
answer
189
views
SQL Injection penn testing from the queries only
Is there an established method or tool available to perform pen testing on an application by only testing queries it sends to the database?
For example, if I have a bunch of SQL Servers hosting ...
- 185
0
votes
1
answer
777
views
PostgreSQL : Prevent SQL Injection in pl/pgsql function [closed]
I am trying to handle sql injection related to startdate and enddate in the below pl/pgsql function.
Let's say If I provide startdate as '2019-10-02' and end date as the following :
2019-10-16', '...
- 3
3
votes
1
answer
351
views
Closing bracket ']' in LIKE wildcard
I have a query that looks a bit like this:
SELECT * FROM Stuff WHERE name LIKE '[a\]]%'
My goal is to match all names starting with a or ] (closed bracket). However, this seems to match everything ...
3
votes
2
answers
2k
views
Dynamic SQL query - how do I add an int to the code?
Consider:
Declare @stringsvar varchar(1000)
Declare @Emp_id int
DECLARE @strvar SYSNAME = 'Employee_test'
SET @stringsvar = ('select * from' + ' ' + @strvar + ' where emp_id' + ' =' + @Emp_id)
...
- 65
1
vote
1
answer
410
views
Security Risks with having Test Stored Procedures that have SQL Injection Vulnerability
I noticed that some of the stored procedures used in our integration tests for data generation have SQL injection vulnerabilities. These procedures are taking into string parameters to build a SQL ...
- 11
2
votes
1
answer
729
views
Dangerous MySQL functions
It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does ...
2
votes
0
answers
63
views
Is SQL Injection possible after filtering " and /?
I'm aiming at building dynamic SQL queries that modify columns. The DBMS doesn't allow parameters to be there, so I can't escape identifier using more robust methods.
To be clearer, using ? or $1 is ...
- 121
0
votes
0
answers
35
views
I have created a website using SQL. I want to know whether my website is safe from the SQL injections or not?
The basic code which I used for the admin login and admin password is:
</style>
<div id="login-form">
<div>
</div>
<div >
<h2 class="text-center">Login<...
1
vote
1
answer
894
views
Why most of Sql Injection need url like this "index.asp?id=123"
I am trying to learn "SQL Injection" concepts and also trying to practice some Kali tools to learn, but there is a question that I do not understand and my question is why do most tools need URL's ...
- 137
2
votes
2
answers
381
views
PostgreSQL. Is using random tag in dollar quoting without escaping input safe?
Is that safe to run such query without escaping input? Assume noone can guess the random string I generate.
SELECT * FROM foo WHERE bar = $long random tag$ THIS NOT ESCAPED $long random tag$
What ...
- 141
2
votes
0
answers
396
views
Is using dollar quoting $$ and removing $ from input enough to avoid SQL injection in PostgreSQL?
I'm coding some logic in embeded Freeswitch LUA and built in database handling
does not allow parametric input for SQL, so I need to escape the input.
I'm sure my username should not have $ symbols ...
- 141
2
votes
1
answer
836
views
Invoke-SqlCmd - does casting as integer prevent injection
I am lazy and would rather parameterize once (to get an object_id for a name) and use Invoke-SqlCmd for the rest of the work.
Given a series of functions meant to work with an arbitrary server ...
- 5,001
2
votes
2
answers
861
views
Safely quoting type names to protect against SQL-injection
How would I quote the type name to protect against SQL Injection. For example, take this
SELECT FORMAT('SELECT CAST(%L AS %s);', '5.42', 'int');
^ ...
- 64.7k
3
votes
1
answer
136
views
Does concating a string like this open me up to SQL injection?
I recently answered a question with the following code sample:
Create Table #Testing
(
emaildomain varchar(100) -- Still bigger than functionally needed but better than MAX
);
INSERT INTO #Testing ...
- 4,793
2
votes
1
answer
1k
views
How to make PostreSQL functions private (inaccessible to end users)?
When writing a set of PostgreSQL functions with procedural languages, is it possible to make some of the supporting functions private and not accessible by end users?
I wanted to refactor some common ...
- 3,692
3
votes
1
answer
195
views
Is it efficient to use plpgsql functions only to validate identifiers and values?
Will my queries be safe from SQL injections if I use plpgsql functions only to validate identifiers and values, instead of executing queries.
Here are the example functions:
CREATE OR REPLACE ...
11
votes
1
answer
2k
views
What function quotes an identifier in dynamic-sql with SQL Server?
What is the SQL Server method of safe-quoting identifiers for dynamic sql generation.
MySQL has quote_identifier
PostgreSQL has quote_ident
How do I ensure given a dynamically generated column name ...
- 64.7k
5
votes
1
answer
3k
views
Microsoft SQL Server SQL Injection Through .NET Even With Quote Escaping [closed]
I've been reading up on SQL Injection as part of a security audit for a fairly large web service. I've been googling and read all the posts I could find here and on SO and have a fairly solid ...
- 469
1
vote
3
answers
981
views
Is there a way to see if database has been accessed through SQL Injection attack?
I recently discovered that my website had a page with a SQL Injection vulnerability. Upon testing, it was easily exploitable with a pentesting tool like sqlmap. How do I figure out if the site ...
- 11
4
votes
2
answers
4k
views
Safe alternative to exec(sql)
I've found some exec(sql) statements buried in the code. They're there for good reason, because these statements couldn't be written directly, however they are an obvious attack vector.
Is there a ...
- 1,011
-1
votes
1
answer
160
views
Stop a person from entering my database and make changes [closed]
This one is probably very easy for most of you to answer and resolve, but not me... I could use some help and guidance.
Someone had got access to my site, and now he keeps deleting tables from the ...
2
votes
0
answers
120
views
JDBC Statement vs. Prepared Statement SQL Injection
as far as I understand a "normal" JDBC Statement which is created via
conn.createStatement()
is prone to SQL-Injection. A prepared statement protects from such attacks. So why/when should I use a ...
- 121
9
votes
1
answer
5k
views
Should we still be using QUOTENAME to protect from injection attacks?
I was looking at an old stored procedure today and noticed it was using quotename on the input parameters. After doing some digging to figure out what that does exactly I came across this site. I now ...
6
votes
1
answer
15k
views
Wildcard search using parameters in function with dynamic SQL
What is the proper way to implement a wildcard search in PostgreSQL when using a parameter in a function that uses dynamic SQL?
As a starting point, here is an example from Erwin Brandstetter ...
- 755
8
votes
3
answers
161
views
Find the source of a recurrent mass SQL edit on a server
I'll try to explain my problem as clear as possible.
The server of a company I support runs many websites. This server runs Windows Server 2012 with Microsoft SQL Server 2014.
Almost all of the ...
- 83
19
votes
2
answers
4k
views
Why does SQL Injection not happen on this query inside a stored procedure?
I made the following stored procedure:
ALTER PROCEDURE usp_actorBirthdays (@nameString nvarchar(100), @actorgender nvarchar(100))
AS
SELECT ActorDOB, ActorName FROM tblActor
WHERE ActorName LIKE '%' ...
- 667
1
vote
1
answer
2k
views
Bringing SQL Server filegroups online
We've experienced an sql injection attack which corrupted our main db.
The main db had two partitioned tables into filegroups.
The corrupt database entered into Suspect mode, and it's been ...
- 443
1
vote
0
answers
414
views
PostgreSQL DML statements
I am trying to trick an application into executing a DML statement AFTER starting a SELECT statement without using stacked queries so I cannot use the ; character anywhere in my query. I have resorted ...
- 33
0
votes
1
answer
1k
views
Explain how this real injection attempt works [closed]
We use stored procedures and so far we haven't detected any injections that have been successful, but we see attempts all of the time. I started logging some of the data hoping to gain insight on ...
- 77
2
votes
1
answer
836
views
Best Practice for Passing and Working With Parameters Security/Performance
Our senior programmer has been having me write stored procedures in the following format to protect against injection attacks. He says that the best practice is to take the parameter in, then declare ...
- 77
1
vote
1
answer
611
views
Can we use TDE as an anti-injection technique
TDE prevent unauthorized access to the data by restoring the files to another server, because it requires the original encryption certificate and master key.
If i applied a table level encryption ...
- 567