Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress the days when I did not use those, or that another way was ever used/taught.)
As I understand it, this cannot possibly cause any security issues, even though the user can obviously set the GET variable to anything they want. It's because the data is "separately" sent to the database software.
Maybe it would be good in some philosophical sense to make sure that $_GET['widget_id'] consists entirely of digits and no other chars, but if the user sets it to whatever blablabla heheheheh;;!!!!!;::: ./d:D:s.s\\DSD/&/"W/edxdDSL>>Z<<><>> 12923947&/¤&&&& ddfd´f´?S´***** -._r, that will just make the query fail -- not enable them to break into the server.
Of course, if the server is misconfigured, that could provoke it to display errors to the user, but that I consider an entirely separate issue.
I tend to only check the values of GET variables (or POST, or anything the user provides or comes from the outside) if they are used for things like determining how many records to LIMIT the SQL result to, because in such cases, they could enter "999999999999999999999999999" and essentially DoS my server, so I make sure it's digits only and that the number is less than a reasonable amount.
If a query fails in my application, I do not continue with the next "step".
Is there any reason to care what crazy value the user provides when using parameterized queries? Have there ever been any cases of this mechanism getting exploited somehow, even with parameterized queries? Is it theoretically possible?
