0

I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL).

There is a client application which allows a user to upload files through it to the server. When the file gets uploaded to the server, Window Service performs required operations on this file and update the details in Database through SQL queries.

Client App(Desktop App) -> File -> Upload on Server -> Window Service Process File -> Database Entry

I was wondering if such kind of architecture really requires parameterized query to prevent SQL injection?

Improve this question
1
  • 1
    Side note: if you're passing over some sort of delimited file, all major RDBMSs have bulk-load utilities, which should be immune to SQL Injection attempts (because you shouldn't be working with statements). Note that this doesn't completely protect you from application compromise, but most attacks are the same ones you have to worry about when doing per-line processing anyways (ie, in a multi-user environment, adding rows belonging to another user).
    – Clockwork-Muse
    Mar 25, 2019 at 22:30

1 Answer 1

Reset to default
1

Parameterized queries are a good idea in almost every case.

All it takes is one mistake in the service which processes the uploaded file and you could have SQL injection issues.

Security is about defense in depth, meaning you use several layers of security in case there's a hole in another part of your system. I would recommend following best practices for SQL queries. In the end it's not strictly required, but it would present an unnecessary risk considering how little effort it takes to parameterize queries.

It can also improve code readability by eliminating the constant opening, closing, and appending of strings where it's easy to miss quotes for a string type parameter.

Improve this answer
2
  • Can you help me with how can an SQL Injection happen in the setup I explained above?
    – Arpit Gupta
    Mar 25, 2019 at 18:08
  • 1
    Let's say the service which is processing the file doesn't correctly sanatise the user input, and allows through a string capable of SQL injection. Something as simple as ' OR 1=1;-- could turn a query that is intended to return 1 result returning multiple. If your processing application was 100% perfect you would be fine for the meantime (although 100% perfect is a very high bar to meet). In the future someone may modify your user file processor and be unaware of it's limitation, and inadvertently let a SQL injection through. Maintainability is important if anyone else ever updates this.
    – Daisetsu
    Mar 25, 2019 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .