Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I'm a training instructor for MySQL. I was telling a group of attendees about the risks of SQL injection, and one guy said, "show me." </p> <p>He handed me his laptop, which had a browser open to the login screen of his website (actually it was just a QA instance of it).</p> <p>Knowing nothing about his code or his database, I made an educated guess that he had an SQL query like yours, that he wasn't using query parameters, and that he wasn't escaping input properly. I entered a string for login including close-quote and some boolean expression, and then I entered random keystrokes for the password. </p> <p>His application authenticated my bogus login, and I was in.</p> <p>I don't think it's appropriate to show you exactly how I did it, but it isn't rocket science -- minimal knowledge of boolean algebra is all you need.</p> <p>But the point is that SQL injection of a SELECT query can allow illicit actions, just like SQL injection of a statement that modifies data.</p> <hr> <p>Re your comments on bad info:</p> <p>It's true that query parameters can't be spoofed, and there's no need to use escaping functions.</p> <p>But query parameters work only in places where you would normally use a single string, date, or numeric literal. Query parameters can't be used for dynamic table names, column names, lists of values, SQL keywords, expressions, etc. For those, you still need to interpolate application variables into your SQL query <em>before</em> calling prepare(), like old-school, unsafe programming. Therefore you still need to be careful to avoid SQL injection vulnerabilities. The best way to do that is to <strong>whitelist</strong> content before including it in SQL queries.</p> <p>See my presentation <a href="http://www.slideshare.net/billkarwin/sql-injection-myths-and-fallacies" rel="nofollow">SQL Injection Myths and Fallacies</a> for more information, or a <a href="http://www.percona.com/webinars/2012-07-25-sql-injection-myths-and-fallacies" rel="nofollow">webinar of me presenting it</a> (free, but requires registration). I also wrote about SQL injection in a chapter of my book, <a href="http://pragprog.com/book/bksqla/sql-antipatterns" rel="nofollow">SQL Antipatterns: Avoiding the Pitfalls of Database Programming</a>.</p>
    singulars
    1. This table or related slice is empty.
    1. POPrepared statement security while fetching
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USBill Karwin
    1. USBill Karwin
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. COI am using prepared statements to write to the database, but I still need to use prepared statements to fetch data? Thanks.
      singulars
      1. PO
      1. USMedeno
    2. COAs Bill mentioned, you need to sanitize the input, be it writing or fetching. In his case, login is retrieving the data (SELECT whether the user and password is correct, there can be no need to write to DB), yet in this case he can login without having the correct user and password.
      singulars
      1. PO
      1. USrcs
    3. COMany programming websites say that there is no need to sanitize user input when using prepared statements, but like you both said, this is not the case. Many people like myself probably have a false sense of security when using prepared statements. Thanks
      singulars
      1. PO
      1. USMedeno
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload