It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols.

In the classic query "SELECT * FROM users WHERE username = '${username}'", if the user inputs, say, ' OR 1=1;--, then that would turn into "SELECT * FROM users WHERE username = '' OR 1=1", and I'm pretty sure most of you can see the problem with that.

However, if simple base64 encoding was used, that would instead turn into "SELECT * FROM users WHERE username = 'JyBPUiAxPTE7LS0='", and could then be decoded when retrieved. This would also allow for symbols and spaces in usernames/passwords.

Unless I am severely misjudging something, this seems a lot simpler than just blacklisting certain words and symbols.

  • Are you doing this base64 encoding via javascript or in the web page? In a programming language such as php or what? – cybernard Jun 9 '18 at 2:07
  • Theoretical discussion. Not doing it at all. – J. Doe Jun 9 '18 at 2:09
  • 4
    The more common approach is to use parameterized SQL. That way you aren't trying to do non-standard encoding/decoding every time you access the data, yet it's not possible to violate the parameters – John Deters Jun 9 '18 at 2:28
  • 2
    And convert everything to CHAR or VARCHAR preventing date and integer comparisons? – AndrolGenhald Jun 9 '18 at 2:41

This would also allow for symbols and spaces... blacklisting certain words and symbols...

What you are talking about? What blacklisting? From the security point of view passwords can contain anything you want. To prevent SQL injection any reasonable application uses prepared statements: Java, C#, PHP. In your case it will generate following SQL, which return no result (unless you really have such a strange user name):

"SELECT * FROM users WHERE username = ''' OR 1=1;--'"

Blacklisting of some symbols is done for better usability, not for security. How would user count spaces, how will he distinguish if there are 2 or 3 spaces in a sequence? How would user enter TAB symbol?

Blacklisting of some passwords like "123" or "abc" is done to prevent guessing them, to prevent dictionary attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.