3 ms·

Table names, and field names are not possible via prepared statements in sqlite. Some language wrappers do not expose the required functions to escape them eit

• kijin 14y ago
  You're probably doing something wrong if you're using user input to construct table names and field names. I can see why this might be necessary in some cases (e.g. year and month in the name of the table), but such cases can be handled relatively easily by using a whitelist and/or validating & sanitizing strictly. If user input needs to be escaped rather than validated & sanitized, you're still doing something wrong. Why would you even have a table name or field name that doesn't match /[a-z0-9_]+/i ?
  • wglb 14y ago
    You're probably doing something wrong if you're using user input to construct table names and field names. This is possibly true. Far more common is to offer the user a drop-down list of field name choices. In that case, the server side should whitelist valid field names before building the sql statement.
    • pyre 14y ago
      Better yet, hard-code the list on the server-side, and have the form only submit an index value to the list (and protect against overflows if necessary in your language/framework of choice). Forcing a translation between the integer and the field name protects against screwing up the white-list somehow and allowing arbitrary input.
• smosher 14y ago
  I sure hope you're not accepting table and field names from an untrusted user. If you can't trust the individual who is administrating the application you might want to rethink some things.