Do semicolons in SQL expose
your database to injection attacks?
QUESTION:
I've noticed that when you write SQL statements
to execute over JDBC with Oracle 10g, you're not supposed to include
the typical ending semicolon. For example, you're supposed to just
write:
"SELECT * FROM MYTABLE"
I was wondering if one reason for this is to cut down on SQL
Injection attacks like those mentioned here:
http://www.tek-tips.com/viewthread.cfm?qid=940825&page=1
ANSWER:
Great question!
From XKCD
Answer from my research: In SQL SERVER, yes.
In Oracle, no!
****************************************************
http://www.webcohort.com/web_application_security/research/white_papers/blindfolded_sql_server_injection.html
Another technique uses the semicolon character.
In SQL, a semicolon is used to chain several SQL statements in the
same line. While with SQL injection this can be used inside the
injection code, the Oracle drivers do not allow use of semicolons in
this manner.
****************************************************
http://online.securityfocus.com/infocus/1644
Statements in Oracle tools and languages are
delimited by semicolons (;) so we can try that next:
SQL> exec get_cust('x'';select username from
all_users where ''x''=''x');
debug:select customer_phone from customers where customer_surname='x';select
username from all_users where 'x'='x'
-911ORA-00911: invalid character
Again this doesn’t work, as another Oracle
error code is returned. Adding a semicolon after the first statement
will not allow a second statement to be executed, so the only way to
get Oracle to execute extra SQL is to either extend the existing
where clause or to use a union or a subselect.
*******************************************************
http://www.imperva.com/application_defense_center/glossary/sql_injection.html
http://www.mydomain.com/products/products.asp?productid=123;DROP
TABLE Products
In this example the semicolon is used to pass
the database server multiple statements in a single execution. The
second statement is "DROP TABLE Products" which causes SQL Server to
delete the entire Products table.
 |
|
Need an Oracle Health Check?
- Do you have
bad performance after an upgrade?
- Need to
certify that your database follows best practices?
BC Oracle performance gurus can quickly
certify every aspect of your
Oracle database and provide a complete verification that your database
is fully optimized. |
|
|
