0

So obviously there is a security error if I have some code like this

execute("Select * where {} = {}".format(input1, input2))

As someone can simply, for input1, send in 1=1; DROP Table Users-- and kill my data. I'm unable to send the inputs as parameters, so I will instead be sanitizing them.

My question is, if I remove semicolons from any input string, can any SQL injection occur, and what would this look like?

  • 2
    Hello Moralous and welcome to Stack Exchange. Your title and question body don't seem to match. In the title you ask if there are multiple ways to do SQL Injections, to which the answer is yes. In the body, you ask if removing semicolons is an effective way of preventing SQL Injections, to which the answer is no. Please edit your question (or the title) to ask one clear and concise question. Please check out How to Ask for more help on how to improve your question. – MechMK1 Apr 3 at 14:04
  • 1
    @MechMK1 I've updated the title. Could you please elaborate, preferably in an answer, why removing semicolons is ineffective, and what an attacker could do instead? – Moralous Apr 3 at 14:06
  • stackoverflow.com/questions/60174/… This seems to have been answered before, but it comes down to what language you want to use. I suggest you check out MySQLi – Crumblez Apr 3 at 19:37
4

The obvious risk is information disclosure e.g. where 0=1 UNION ALL select secret_data from somewhere_else or a myriad of other ways.

Depending on server configuration, the same select may allow to (for example) access the filesystem e.g. union select "someinterestingcode" into outfile '/var/www/backdoor.php' or something like that.

Sanitizing arbitrary data by filtering "everything" is very hard to do properly. It's prudent to find a way to do proper parametrized queries, even if that's not easy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.