3 ms·
Actually, no. Stored Procedures can contain dynamic SQL, which is the actual problem, so it is quite possible to have a stored procedure with SQL Injection buil
by danielrm26 14y ago
Actually, no. Stored Procedures can contain dynamic SQL, which is the actual problem, so it is quite possible to have a stored procedure with SQL Injection built into it. This would yield high-performance SQL Injection and little else.
The better answer is a parameterized query, which actually controls the inputs properly to ensure that no dynamic SQL is possible.
- bni 14y agoSP:s was never mentioned in the post you are replying to, but ofcourse if you use dynamic SQL in them (execute immediate in Oracle) it is just as bad as doing string concatenation in other languages. Just dont do that.
- derpmeister 14y agoIt would be a silly thing to do because you keep exactly the same problem you'd have without stored procedures. Would the client you're writing rather execute something along the lines of SELECT sp_enroll("bob\"); DROP TABLE students; --"); or SELECT sp_enroll("bob"); DROP TABLE students; --"); ? At least if you grant the user only SELECT and EXECUTE privileges and define the procedures using the SECURITY DEFINER property, you could still prevent this type of damage. (This relies on the procedures to be as strict as possible or the whole scheme essentially fails.)