3 ms·
I'll probably never understand why people believe that a stored proc is not subject to injection attacks. Like they're magic or something.
by spacemanmatt 11y ago
I'll probably never understand why people believe that a stored proc is not subject to injection attacks. Like they're magic or something.
- thornygreb 11y agoBecause if you use the input parameters correctly they are immune to injection. If you concatenate unsanitized input you are susceptible no matter where you write the SQL.
- mateuszf 11y agoThough that's also true if it's done application-server side.
- spacemanmatt 11y agoYup. Examples: value stored in a table is concatenated into a query without escapement, leaving it vulnerable to injection. Whose job was it to ensure the DB contained clean data? My policy has been to call quote_identifier or quote_literal (PostgreSQL) where applicable, or use typecasts to enforce value literals.
- spacemanmatt 11y agoI get that. That is exactly the same condition as sanitizing inputs in every other context of passing parameters to a service/proc/func. I would not phrase immunity to injection conditionally; there is no immunity, only sanitizing inputs.