Does this mean my SQL query is safe? Is there any way someone can break my query and view all the records?
No, it is not safe. More than being able to view all the records of one table, you can pass in:
If you get any output then you know that:
- There is a table called
- That table has the columns
- There is a row where the username is
Admin and the password hash is
And the passed in expression does not use the
-*|%/ characters or any whitespace and results in a valid SQL expression.
A determined attacker could then use this type of query to pull out data from any table the connected user has access to.
Don't use string concatenation to include user input into queries; use prepared statements with parameters. For example:
"SELECT * FROM table_name WHERE RECORD LIKE '%' || ? || '%'"
And pass your dynamic value in as a bind parameter.