4

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic SQL.

I'm curious if there are any other edge case scenarios where SQL Injection is still possible even if you are using parameterized queries? Is dynamic SQL the only catch?

Improve this question

2 Answers 2

Reset to default
6

The only one that immediately comes to mind is second order injection where a value such as 123' or 1=1 -- is stored in a table which is later retrieved and then used unfiltered in a query. It does usually require the code to not parameterize data retrieved from the database which is not that uncommon as developers often consider this a "trusted" source.

Improve this answer
8
  • Good answer. It's also possible to insert malicious data that performs other forms of injection, such as XPATH or XSS.
    – John Deters
    Nov 19, 2014 at 22:28
  • SQL injection is SQL injection, no matter where the injected data came from.
    – Gumbo
    Nov 19, 2014 at 23:53
  • 2
    I never said it wasn't SQL injection?
    – wireghoul
    Nov 20, 2014 at 0:05
  • 2
    It matters when you have to patch the vulnerability. Knowing that its second order means you look at places where database values are used as opposed to where the values gets accepted from the user.
    – wireghoul
    Nov 20, 2014 at 9:07
  • 1
    @Gumbo, it absolutely matters when I am specifically asking how the sql injection would take place.
    – Abe Miessler
    Nov 20, 2014 at 15:53
-1

Using prepared statements with parameters only ensures that the given parameters are securely passed to the DBMS as intended. Such a prepared statement definitely won’t be injectable.

However, when the prepared statement itself utilizes functionalities like stored procedures that contain injection flaws themselves, you’re obviously still vulnerable. But it’s not the prepared statement that’s vulnerable but the stored procedure (which could probably also use prepared statements as mitigation).

Improve this answer
3
  • -1, I feel like you are repeating what I said in my original question and also not answering what I asked. This might be better off as a comment. I do agree that the stored proc is what is vulnerable, but I don't think that using a prepared statement would protect against the dynamic sql scenario I described would it?
    – Abe Miessler
    Nov 20, 2014 at 15:59
  • @AbeMiessler Prepared statements with parameterization is the solution to SQL injections, even when you’re building the query dynamically. Yes, it gets more complicated. But there are techniques like ORM that have already solved this problem of building SQL statements dynamically. Use them, don’t build your own.
    – Gumbo
    Nov 20, 2014 at 16:34
  • Chat? chat.stackexchange.com/rooms/18839/sql-injection
    – Abe Miessler
    Nov 20, 2014 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .