With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle (SQL*Plus) but cannot seem to find an issue with the ampersand. I've referenced multiple cheat sheets and articles, and cannot find a reference to it (other than Oracle).
Add a comment
|
2 Answers
Technically yes, but no more so than any other T-SQL syntax. The & is used for bitwise actions, and if there is an applicable SQL injection vulnerability found, an attacker could use it to probe for more information about the structure of the query/data, but it's a very specialized scenario, and, in my opinion, a very low priority. I can think of many more reasons to whitelist an ampersand than I can to blacklist it.
See the link below for more documentation about the operator.
https://docs.microsoft.com/en-us/sql/t-sql/language-elements/bitwise-and-transact-sql?view=sql-server-2017
You can do the following:
You have to replace the ' by Chr(146). For example, in vb.net you can use string.Replace("'", Chr(146)).
SQL accepts chr(146), but not the chr(39).
