4

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic SQL.

I'm curious if there are any other edge case scenarios where SQL Injection is still possible even if you are using parameterized queries? Is dynamic SQL the only catch?

2 Answers 2

6

The only one that immediately comes to mind is second order injection where a value such as 123' or 1=1 -- is stored in a table which is later retrieved and then used unfiltered in a query. It does usually require the code to not parameterize data retrieved from the database which is not that uncommon as developers often consider this a "trusted" source.

8
  • Good answer. It's also possible to insert malicious data that performs other forms of injection, such as XPATH or XSS. Nov 19, 2014 at 22:28
  • 2
    I never said it wasn't SQL injection?
    – wireghoul
    Nov 20, 2014 at 0:05
  • 2
    It matters when you have to patch the vulnerability. Knowing that its second order means you look at places where database values are used as opposed to where the values gets accepted from the user.
    – wireghoul
    Nov 20, 2014 at 9:07
  • 1
    @Gumbo, it absolutely matters when I am specifically asking how the sql injection would take place. Nov 20, 2014 at 15:53
-1

Using prepared statements with parameters only ensures that the given parameters are securely passed to the DBMS as intended. Such a prepared statement definitely won’t be injectable.

However, when the prepared statement itself utilizes functionalities like stored procedures that contain injection flaws themselves, you’re obviously still vulnerable. But it’s not the prepared statement that’s vulnerable but the stored procedure (which could probably also use prepared statements as mitigation).

3
  • -1, I feel like you are repeating what I said in my original question and also not answering what I asked. This might be better off as a comment. I do agree that the stored proc is what is vulnerable, but I don't think that using a prepared statement would protect against the dynamic sql scenario I described would it? Nov 20, 2014 at 15:59
  • @AbeMiessler Prepared statements with parameterization is the solution to SQL injections, even when you’re building the query dynamically. Yes, it gets more complicated. But there are techniques like ORM that have already solved this problem of building SQL statements dynamically. Use them, don’t build your own.
    – Gumbo
    Nov 20, 2014 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .