0

I've read few articles about sql injection prevention. Most of them recommend using prepared statement to prevent sql injection and whitelisting is just an additional solution. I can't get their points.

IMHO, whitelisting user input is much better since it can also prevent XSS attack. Whitelisting is just not possible when no character is restricted. And this case is infrequent.

Let's consider this example in nodejs.

Prepared statement

DB.query("UPDATE user SET username=?",username,cb);

Whitelisting

//assume that username is alphabetic
if(!/^[a-z]+$/.test(username)){
    throw new Error('Invalid user name');
}
DB.query("UPDATE user SET username='"+username+"'",cb);

What do you guys think? Whitelisting or prepared statements? Why don't you recommend whitelisting user input over prepared statements?

9
  • 4
    Don't know why you are calling the second option "whitelisting". It looks like you are talking about data validation. IMO you should have BOTH validation of all input data as well as use prepared statements. Think about defense in depth. Additionally, validation also gives you a hook to provide feedback to the application user that they are entering unexpected values. Unfortunately, this question is one which is likely to get a range of opinions.
    – Mike Brant
    Apr 7, 2015 at 14:49
  • 2
    Data validation may be "good enough" in the simplistic use case you have shown above where you are only going to allow alphabetic entries, but what about more complex cases (email validation, free form text validation, validation of arbitrary data structures (like JSON string), etc.)? Do you want to have your application use prepared statements in some cases and concatenated queries in others?
    – Mike Brant
    Apr 7, 2015 at 14:53
  • 3
    Frankly, you should be doing both of these things. Always. And probably several other security measures. To be blunt, if you are relying on just one technique to ensure security, its not a matter of IF you'll get bit, but when. Security in a public-facing application is never a matter of a single "magic bullet" technique that solves all your problems. It should be more like an arsenal of coordinated defenses so that if one goes down or is hacked in an unforeseen way, there's a lot of backup behind it. Apr 7, 2015 at 16:10
  • 2
    Also, as @MikeBrant points out, that is not "whitelisting", but input validation. As a rule of thumb, it should always be done for anything coming from an untrusted (i.e. a user, even a "logged in" one, or any code from outside your application) source. Apr 7, 2015 at 16:16
  • 2
    The validation is just for verifying the input is compliant to your data model. And the prepared statement is for ensuring the data is properly passed to the database. Don’t mix them, they are separate and independent responsibilities!
    – Gumbo
    Apr 7, 2015 at 16:19

1 Answer 1

5

Prepared statements absolutely prevent SQL injection vulnerabilities in statements where they are used, period, paragraph.

Validating or "sanitizing" your input may appear similarly effective, but the unquestioned consensus among experts is that there is no effective alternative for prepared statements, and concatenated queries are simply unacceptable.

There are ways of getting bad data past validation attempts that you have not yet imagined, and likely never will, until your server is exploited. There are, for example, exploits involving alternate character sets, which can sail right through what seems like proper validation or escaping.

But the apparent effectiveness aside, there's also an overriding principle at play: the fundamental and vital aspect of prepared statements that you appear not to be considering is that they impose the correct separation between "code" and "data." (In other environments, a breach of the boundary between code and data is at the heart of "buffer overrun" vulnerabilities.) In SQL, the query is the code, and the values supplied are data. They are different kinds of "things," and should be kept segregated, as a matter of principle.

Prepared statements don't simply substitute the ? with the values. The query and the values are provided separately to the database server in different data structures. With this mechanism, it becomes literally impossible for the database server to get it wrong and blur the boundary.

An effective illustration of this fact is the fact that you can't use ? placeholders for database object identifiers, like table or column names, providing the value as an argument. That doesn't work, because it is not supposed to work. Table and column names are part of the code, not part of the data.

"Impossible" to get it wrong is a term that you can't apply to your attempts at input validation.

Usernames are also an overly simplistic example, since they are easily constrained to ascii alpha. Many or most other columns are not. Make a change, later, and "oops," you forgot to handle something. Perhaps it was something inconceivably remote and unlikely, but now it's just waiting to be exploited.

There have also been a number of excellent comments to your question, which you would do well to take into consideration.

Prepared statements are the correct mechanism for handing outside data to a database... but I would argue that experts and professionals don't even ask themselves whether the data source is trustworthy or not -- we use placeholders and prepared statements consistently and unconditionally, without regard to the origin of the data we're passing.

Of course, it should be obvious that my point is not to downplay protecting against other vulnerabilities, but that is not the role of prepared statements. However effective other mechanisms may appear at assisting with the task, and however useful they may be for their intended purpose, they are not a substitute for proper handling of data on its way to the dbms.

5
  • From your point, I belive that you don't second the one who separate data into trusted and untrusted one in the aspect of sql injection. Why should I use prepared statements with a query that only use the trusted data since there is no posibility of sql injection? I think prepared statements just unintentionally prevent sql injection with its principle. I would never believe that massively applying anything is the best solution.
    – Lewis
    Apr 8, 2015 at 4:26
  • "Impossible" to get it wrong is a term that you can't apply to your attempts at input validation. This is not true. Assume that I have this query SELECT * FROM user WHERE id=aNumericValue. Sql injection will be impossible if I reject all non-numeric values.
    – Lewis
    Apr 8, 2015 at 4:32
  • Let's be clear: the fact that prepared statements prevent SQL injection vulnerabilities is not the primary reason for using them. The primary reason is because it is the most logically and conceptually sound and correct way to present queries with values from variables to the database. As bonuses, they also eliminate SQL injection and, for queries that are repeated with different values, the query only has to be parsed once by the server. If that's not enough, your code looks careless and lazy when you concatenate queries, as though you've been reading sloppy "Learn PHP & MySQL" books. Apr 8, 2015 at 4:54
  • your code looks careless and lazy when you concatenate queries. Input validation actually takes much more effort in comparision with the prepared statements approach. BTW, regardless how sloppy the books I've been reading, it should make sense.
    – Lewis
    Apr 8, 2015 at 5:15
  • No one is arguing about the relative level of difficulty, effort, or complexity. You don't have to listen to reason and accept the industry consensus but there's really nothing up for debate, here. Apr 8, 2015 at 15:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.