1

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my client did was to use a blacklist, which could be easily circumvented (e.g. use 'DEL'+'ETE' instead of DELETE to prevent detection).

Would SQL injection still be possible if the user input is parsed by a parser first? The user inputs an SQL string, and if there's a blacklisted keyword, it gets omitted. If the input has something like 'DEL'+'ETE' in it, the parser would parse it to DELETE (which is blacklisted) and the request would be omitted. Is there a way around this? How could injection still be possible? The parser that is used has no known vulnerabilities itself.

The only thing that google lead me to was Parse-Tree validation, which is also not possible because the user-supplied queries can have different parse-trees each time.

Thank you for your help.

2

Your approach could probably be bypassed as well, maintaining a blacklist is a "why not" but is definitely not efficient.

Depending on the technical stack you use, I'd suggest you use an ORM which will reduce your risque (but is not risk-free neither)

The best thing you can do is trust no-one: Assume all user-submitted data is evil and validate and sanitize everything: Escape all user-supplied input; almost every programming language has a bunch of functions to sanitize user input.

Checking the length of the given pram before using it could help also. You can as well, in cases where params are ints, try to cast the string to int before using it.

3
  • thank you for your answer. could you explain how a ORM in this scenario would be more secure? The user input is a SQL-statement that will be performed. so if a ORM is used it would also be performed in the same way, i assume? because of that, escaping things like quotes etc. also doesn't work, as quotes used in valid statements have to keep working.
    – kappadoky
    Jan 26 at 16:10
  • 1
    Sorry. Indeed my answer doesn't make any sense! the best I guess you can do is applying the principle of least privilege... Jan 26 at 16:41
  • your answer makes perfect sense, however not for this special scenario. but do you think the parser ups the security at least a bit?
    – kappadoky
    Jan 26 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.