4

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic SQL.

I'm curious if there are any other edge case scenarios where SQL Injection is still possible even if you are using parameterized queries? Is dynamic SQL the only catch?

6

The only one that immediately comes to mind is second order injection where a value such as 123' or 1=1 -- is stored in a table which is later retrieved and then used unfiltered in a query. It does usually require the code to not parameterize data retrieved from the database which is not that uncommon as developers often consider this a "trusted" source.

  • Good answer. It's also possible to insert malicious data that performs other forms of injection, such as XPATH or XSS. – John Deters Nov 19 '14 at 22:28
  • 2
    I never said it wasn't SQL injection? – wireghoul Nov 20 '14 at 0:05
  • 2
    It matters when you have to patch the vulnerability. Knowing that its second order means you look at places where database values are used as opposed to where the values gets accepted from the user. – wireghoul Nov 20 '14 at 9:07
  • 1
    @Gumbo, it absolutely matters when I am specifically asking how the sql injection would take place. – Abe Miessler Nov 20 '14 at 15:53
-1

Using prepared statements with parameters only ensures that the given parameters are securely passed to the DBMS as intended. Such a prepared statement definitely won’t be injectable.

However, when the prepared statement itself utilizes functionalities like stored procedures that contain injection flaws themselves, you’re obviously still vulnerable. But it’s not the prepared statement that’s vulnerable but the stored procedure (which could probably also use prepared statements as mitigation).

  • -1, I feel like you are repeating what I said in my original question and also not answering what I asked. This might be better off as a comment. I do agree that the stored proc is what is vulnerable, but I don't think that using a prepared statement would protect against the dynamic sql scenario I described would it? – Abe Miessler Nov 20 '14 at 15:59
  • @AbeMiessler Prepared statements with parameterization is the solution to SQL injections, even when you’re building the query dynamically. Yes, it gets more complicated. But there are techniques like ORM that have already solved this problem of building SQL statements dynamically. Use them, don’t build your own. – Gumbo Nov 20 '14 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.