I understand the basic process of SQL injection attack. I was told that one way to prevent such an attack is by frequently changing the table name! Is that possible? If so, can someone provide me a link to read about it more because I couldn't find an explanation about it on the web.
Add a comment
|
2 Answers
Changing the table name periodically will make SQL injection a bit harder (you can no longer blindly register a username of Robert'); DROP TABLE Students;-- to cause havoc). However, there are SQL injection techniques for figuring out table names, which can bypass your defenses.
The correct way to prevent SQL injection is to use parameterized queries. This completely stops injection, and is far less complicated than re-writing your queries every time you change your table names.
-
Thank you Mark. I was told by my advisor that such a defense technique exists so I need to read about it in order to understand how this defense is performed. Do you think I can find a link explaining such a technique? Commented Oct 12, 2016 at 22:12
-
What your advisor gave you is a prime example of security through obfuscation. That is, it's hiding your application's insecurity behind a layer of your own ignorance. Commented Oct 12, 2016 at 22:52
No.
With most DBMS you can access table and database information via information_schema, so hiding your table names doesn't provide any benefit. Even with those DBMS that do not provide this information, table names can be bruteforced and other attacks may be possible as well (writing to files, executing system commands, bypassing authentication, etc).
The only proper defense against SQL Injection are prepared statements. Proper permissions as well as reasonable input filtering are useful as defense in depth.
But even as defense in depth, frequently changing table names doesn't seem to be a reasonable approach as it is way too much trouble with too little or no to gain. At the most, you may consider using non-default table names or some table prefix to possibly avoid some automated exploitation of known vulnerabilities (but even that is a long shot and not really worth the trouble).
