Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upAvoid SQL Injection in debug SQL #303
Conversation
I was happily making some other contributions to the codebase when I decided to try testing for SQL Injection vulnerabilities. I was dismayed when all my single quotes were not escaped in WHERE clauses and nearly had a panic attack until I realized that the SQL validated in the majority of these tests is just a debug mashup that includes parameter bindings. Nevertheless, I think it makes sense to escape single quotes properly even in the debug SQL strings, if only to avoid giving some other hapless maintainer a heart attack.
|
Thank you for this contribution, but as you've said that the --- UNSAFE SQL: SELECT * FROM [Table] |
|
I think there is still value in sanitizing the debug SQL. I've used the debug string before to spot check problems quickly by copying and pasting into SQL Management Studio. Purposely leaving single quotes unescaped feels like an odd omission that will only cause confusion. Prefixing the string with -- Warning: This SQL is for debugging purposes only. Learn more at https://sometiny.url
SELECT * FROM [Table] |
ahmad-moussawi
force-pushed the
sqlkata:master
branch
6 times, most recently
from
f9a6417
to
a30bb49
freakingawesome commentedOct 8, 2019
I was happily making some other contributions to the codebase when I
decided to try testing for SQL Injection vulnerabilities. I was dismayed
when all my single quotes were not escaped in WHERE clauses and nearly
had a panic attack until I realized that the SQL validated in the
majority of these tests is just a debug mashup that includes parameter
bindings.
Nevertheless, I think it makes sense to escape single quotes properly
even in the debug SQL strings, if only to avoid giving some other
hapless maintainer a heart attack.