Is it possible to perform SQL injection on a query where the name of the table is passed in as an argument? The user doesn't enter the table name themselves, but it can be inferred through element IDs. I am using Microsoft SQL Server 2012 with Coldfusion 10, if that helps.


SELECT * FROM [Database].[dbo].[#tableName#]

Could the #tableName# parameter be used to inject malicious code?

Also, could the parameter names be vulnerable to injection as well?

Second example:

SELECT * FROM [Database].[dbo].[#tableName#] WHERE [#paramName#] = '#paramValue#'

The second example assumes the use of Coldfusion's cfqueryparam for setting the #paramValue#, so the question is more geared towards the use of [#paramName#].


Yes. I'm assuming that you are building your query with string concatenation.

Let's take

SELECT * FROM [Database].[dbo].[#tableName#]

If you replace #tableName# by employee]; DELETE FROM [Database].[dbo].[employee you then obtain 2 queries

SELECT * FROM [Database].[dbo].[employee];
DELETE FROM [Database].[dbo].[employee];

There is only one way to fix SQL Injection : use parametrized queries.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.