Regarding SQL Injection at Back End?

Question

I have logged into SQL Server 2008 Database and executed following query:

select * from USER_Main_INFO_Name where userid ='' or 'x'='x'

After executing the query Database has given total user list.

Using Burp Tool I have done SQL Injection at front end my application has given proper error result.

Is my application strong? How to avoid SQL Injecting at Backend?

Answer 1

This implies that at some point you are constructing SQL statements by string concatenation involving untrusted strings. Don't do that! Use prepared statements instead (or some other form of query parameterization), as they are pretty much intrinsically immune to SQLi.

I'm assuming you mean your frontend successfully blocks all the SQLi you tried. This doesn't mean it will block all SQLi, of course; that depends on how thorough your testing is.

However, once the query reaches your backend (assuming that's your DBMS), there really isn't any way to tell what SQL comes from SQLi and what SQL is legitimate. You really have to trust that what's coming in on the database connection is trustworthy.

Of course, it is wise to limit the impact of such attacks as much as possible. Most simply, and commonly, you can limit the permissions of the application's service account on the database to only those actions it actually performs. This doesn't prevent SQLi per se, but it will lessen the impact if any exists.

Another possible approach is to abstract some of the SQL away in a data access layer the frontend talks to, and avoid passing any strings to the DBMS that didn't come from the application itself (and certain trusted columns in certain tables). It's much easier to just use prepared statements.

Answer 2

The best way to prevention SQL injections at front-end is to use prepared statements. If you want to restrict users from accessing the data base itself you can use the account management tools like CREATE USER, GRANT INSERT ..., REVOKE ... which are shipped along the DBMS itself. If this doesn't satisfy your desired level of security, you can start using database firewalls. A further approach to deny users from accessing your database is to introduce a data access baseline. A baseline means that you create an access protocol which contains all access points that are allowed to get access to the target db. A simple example would be:

DB-USER | IP-Address   | Source Program
----------------------------------------
admin   | 5.200.200.20 | OraDriver.exe
herby   | 192.186.2.10 | DbUtil.exe

In case that an incoming request deviates from the base line, a specific action gets executed like, notify an administrator (behavior like an intrusion detection system), blocking the request, etc.