2

My VB.net page has a text box that accepts SQL statements and returns a DataSet using ExecuteDataSet command of SQL Helper. What do you think is the best way to prevent statements such as Delete, Truncate, Drop, Insert, etc. from being executed? The text box should only accept Select statements. I'm thinking of trapping the input string thru Javascript or thru server validation but I'm sure there are more efficient ideas to do this. Thanks in advance.

EDIT: My text box acts like a query analyzer, therefore it accepts a line of SQL statement and then return a dataset based on the entered string

5
  • 3
    best way is to parameterized the query by using SQLCommand and Parameter
    – John Woo
    Commented Mar 15, 2013 at 3:32
  • stackoverflow.com/questions/6547986/…
    – Pyromancer
    Commented Mar 15, 2013 at 3:34
  • 1
    Then start worrying about js/html injections
    – Dan Bracuk
    Commented Mar 15, 2013 at 3:35
  • Just to be clear, my text box acts like a query analyzer, therefore it accepts a line of SQL statement and then return a dataset based on the entered string
    – Mark U
    Commented Mar 15, 2013 at 3:36
  • is comboBox fit, so that they will just select?
    – Pyromancer
    Commented Mar 15, 2013 at 3:38

4 Answers 4

5

First, let me state for the record that your design is a really bad idea; you are exposing your database to great risk.

A better design would be to let your users select from a list of fields that they can select. This avoids allowing a user to type in a SQL statement.

However, if you are absolutely determined to do this, then build an array of the keywords you want to block. Then, after the user input, loop through the array checking for any of the blocked words. If any of the blocked words are found, then you don't execute the SQL.

It's a bad idea, though. You shouldn't do this.

6
  • +1 to this being a bad idea. However, I would instead recommend whitelisting instead of blacklisting. Commented Mar 15, 2013 at 3:41
  • I thought of whitelisting, but I was concerned that might still allow a clever attacker to build a statement that has a harmful payload. Your point is well taken, though. Thanks!
    – DWRoelands
    Commented Mar 15, 2013 at 3:44
  • Thanks guys for the answers. I know this is a risky approach but this has been rolled out already so I'm thinking of ways to prevent SQL attacks. That's what I can do for now.
    – Mark U
    Commented Mar 15, 2013 at 3:47
  • 1
    @markuy, If this has already rolled out, you should be thinking of ways of detecting the SQL injection attacks instead of preventing them. Commented Mar 15, 2013 at 4:08
  • Bill's probably right on that. presumably you know the structure of the data you will be returning looks like. You could parse that before returning it to see if there is data that should not be exposed to the user in there.
    – yu_ominae
    Commented Mar 15, 2013 at 5:21
1

There are lots of ways to do this but I usually just code my dynamic sql using sp_executesql with parameters. Here is the example from BOL.

DECLARE @IntVariable int;
DECLARE @SQLString nvarchar(500);
DECLARE @ParmDefinition nvarchar(500);

/* Build the SQL string one time.*/
SET @SQLString =
     N'SELECT BusinessEntityID, NationalIDNumber, JobTitle, LoginID
       FROM AdventureWorks2008R2.HumanResources.Employee 
       WHERE BusinessEntityID = @BusinessEntityID';
SET @ParmDefinition = N'@BusinessEntityID tinyint';
/* Execute the string with the first parameter value. */
SET @IntVariable = 197;
EXECUTE sp_executesql @SQLString, @ParmDefinition,
                      @BusinessEntityID = @IntVariable;
/* Execute the same string with the second parameter value. */
SET @IntVariable = 109;
EXECUTE sp_executesql @SQLString, @ParmDefinition,
                  @BusinessEntityID = @IntVariable;

Sp_executesql allowes you to put parameters into your dynamic code and they are treated just like a variable. That way if someone tries to inject code into a field the code they "inject" is just stored in the column.

1

One method of preventing SQL injection is to avoid the use of dynamically generated SQL in your code. By using parameterized queries and stored procedures, you then make it impossible for SQL injection to occur against your application.

By passing parameters you avoid many types of SQL injection attacks, and even better method of securing your database access is to use stored procedures. Stored procedures can secure your database by restricting objects within the database to specific accounts, and permitting the accounts to just execute stored procedures. Your code then does all database access using this one account that only has access to execute stored procedures. You do not provide this account any other permissions, such as write, which would allow an attacker to enter in SQL statement to executed against your database

1

Along the lines of what DWRoeland answered, if you insist on building the query with user text input, you will need heavy screening of input.

However, in contrast to the suggestion, I would suggest using a whitelist approach: Having a pre-determined collection of allowed keywords. It is much easier to screen what is acceptable, than to try and block everything that is unacceptable.

Just an additional note:
If you were to choose the dropdown list approach to construct queries, you would still want to validate the values, as a user can still tamper with these values before the postback and wreak havoc on a database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.