I have logged into SQL Server 2008 Database and executed following query:

select * from USER_Main_INFO_Name where userid ='' or 'x'='x'

After executing the query Database has given total user list.

Using Burp Tool I have done SQL Injection at front end my application has given proper error result.

Is my application strong? How to avoid SQL Injecting at Backend?

  • This is not an issue. If you want to prevent people from querying your database, then you should be restricting access. Removing SELECT statements will break almost all applications. Dec 26, 2013 at 10:20
  • Can you expand on what you mean by the following: Using Burp Tool I have done SQL Injection at front end my application has given proper error result. Dec 26, 2013 at 16:41
  • Dear Abe Miessler,I have set proxy setting in browser then ON Intercept option in Burp tool ,then given valid user name and password then click login button.After clicking login button i have changed user name like "asd123'or '1'='1" then forward request to server from Burp Tool.Now server given result as "Application has generated an error Please contact to administrator"
    – user35819
    Dec 27, 2013 at 8:59

2 Answers 2


This implies that at some point you are constructing SQL statements by string concatenation involving untrusted strings. Don't do that! Use prepared statements instead (or some other form of query parameterization), as they are pretty much intrinsically immune to SQLi.

I'm assuming you mean your frontend successfully blocks all the SQLi you tried. This doesn't mean it will block all SQLi, of course; that depends on how thorough your testing is.

However, once the query reaches your backend (assuming that's your DBMS), there really isn't any way to tell what SQL comes from SQLi and what SQL is legitimate. You really have to trust that what's coming in on the database connection is trustworthy.

Of course, it is wise to limit the impact of such attacks as much as possible. Most simply, and commonly, you can limit the permissions of the application's service account on the database to only those actions it actually performs. This doesn't prevent SQLi per se, but it will lessen the impact if any exists.

Another possible approach is to abstract some of the SQL away in a data access layer the frontend talks to, and avoid passing any strings to the DBMS that didn't come from the application itself (and certain trusted columns in certain tables). It's much easier to just use prepared statements.

  • IMO using the terminology "prepared statements" adds unnecessary confusion - as that typically refers to a specific feature - but : to get safety, it isn't so much "prepared" that is important - it is "parameterized". Ad-hoc, not formally "prepared", but parameterized sql is perfectly safe. Dec 26, 2013 at 17:54
  • Yeah, parametrized statements in general work well. Of course, if you use an API layer to do it, you have to be sure it is actually parametrizing them when it sends them. Dec 26, 2013 at 19:27

The best way to prevention SQL injections at front-end is to use prepared statements. If you want to restrict users from accessing the data base itself you can use the account management tools like CREATE USER, GRANT INSERT ..., REVOKE ... which are shipped along the DBMS itself. If this doesn't satisfy your desired level of security, you can start using database firewalls. A further approach to deny users from accessing your database is to introduce a data access baseline. A baseline means that you create an access protocol which contains all access points that are allowed to get access to the target db. A simple example would be:

DB-USER | IP-Address   | Source Program
admin   | | OraDriver.exe
herby   | | DbUtil.exe

In case that an incoming request deviates from the base line, a specific action gets executed like, notify an administrator (behavior like an intrusion detection system), blocking the request, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.