Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.databases.ms-sqlserver > #1864 > unrolled thread

SQl -injection

Back to article view | Back to comp.databases.ms-sqlserver

Contents

  SQl -injection "Tony Johansson" <johansson.andersson@telia.com> - 2015-01-28 12:45 +0100
    Re: SQl -injection Lennart Jonsson <erik.lennart.jonsson@gmail.com> - 2015-01-28 14:41 +0100
      Re: SQl -injection "Tony Johansson" <johansson.andersson@telia.com> - 2015-01-29 11:03 +0100
    Re: SQl -injection Erland Sommarskog <esquel@sommarskog.se> - 2015-01-28 13:45 +0000

#1864 — SQl -injection

In the form there is a text field for name

This query is meant to be used like his
select Namn, Adress, Telefonnummer
from Abonnent
where Namn = 'Olle Karlsson'      //This name is fetched from the text field 
name in the form
and hemligtNummer = false;

If now the user enter some strange character in the text field in the form 
like this
select Namn, Adress, Telefonnummer
from Abonnent
where Namn = 'Olle Karlsson' or 'a'='a' or 'a'='a'
and hemligtNummer = false;

I don't understand how the second query can result that all rows will be 
fetched

//tony
 

[toc] | [next] | [standalone]

#1865

On 2015-01-28 12:45, Tony Johansson wrote:
> In the form there is a text field for name
>
> This query is meant to be used like his
> select Namn, Adress, Telefonnummer
> from Abonnent
> where Namn = 'Olle Karlsson'      //This name is fetched from the text
> field name in the form
> and hemligtNummer = false;
>
> If now the user enter some strange character in the text field in the
> form like this
> select Namn, Adress, Telefonnummer
> from Abonnent
> where Namn = 'Olle Karlsson' or 'a'='a' or 'a'='a'
> and hemligtNummer = false;
>
> I don't understand how the second query can result that all rows will be
> fetched
>

The where clause evaluates to

     where Namn = 'Olle Karlsson'
        or 'a'='a'
        or ('a'='a' and hemligtNummer = false);


/Lennart

[toc] | [prev] | [next] | [standalone]

#1867

Yes I can understant why it fetches alla the rows now.
Many thanks.

//Tony

"Lennart Jonsson" <erik.lennart.jonsson@gmail.com> skrev i meddelandet 
news:maaotr$e36$1@dont-email.me...
> On 2015-01-28 12:45, Tony Johansson wrote:
>> In the form there is a text field for name
>>
>> This query is meant to be used like his
>> select Namn, Adress, Telefonnummer
>> from Abonnent
>> where Namn = 'Olle Karlsson'      //This name is fetched from the text
>> field name in the form
>> and hemligtNummer = false;
>>
>> If now the user enter some strange character in the text field in the
>> form like this
>> select Namn, Adress, Telefonnummer
>> from Abonnent
>> where Namn = 'Olle Karlsson' or 'a'='a' or 'a'='a'
>> and hemligtNummer = false;
>>
>> I don't understand how the second query can result that all rows will be
>> fetched
>>
>
> The where clause evaluates to
>
>     where Namn = 'Olle Karlsson'
>        or 'a'='a'
>        or ('a'='a' and hemligtNummer = false);
>
>
> /Lennart
>
> 

[toc] | [prev] | [next] | [standalone]

#1866

Tony Johansson (johansson.andersson@telia.com) writes:
> In the form there is a text field for name
> 
> This query is meant to be used like his
> select Namn, Adress, Telefonnummer
> from Abonnent
> where Namn = 'Olle Karlsson'      //This name is fetched from the text 
> field 
> name in the form
> and hemligtNummer = false;
> 
> If now the user enter some strange character in the text field in the form 
> like this
> select Namn, Adress, Telefonnummer
> from Abonnent
> where Namn = 'Olle Karlsson' or 'a'='a' or 'a'='a'
> and hemligtNummer = false;
> 
> I don't understand how the second query can result that all rows will be 
> fetched

So that depends on you submit the query. If you submit the query as:

cmd.CommandText = 
    @"select Namn, Adress, Telefonnummer
      from Abonnent
      where Namn = @name";
cmd.Parameters.Add("@name", SqlDbType.NVarChar, 50).Value = "Olle Karlsson";

There is no issue. (The syntax is C#, but all environments permits you do
things like this.)

But if you do: 

cmd.CommandText = 
    @"select Namn, Adress, Telefonnummer
     from Abonnent
     where Namn = '" + TextBox.Text + "'";

This is wide open for SQL injection. For instance try to enter this in the 
textbox and see what happens:

  ' SHUTDOWN WITH NOWAIT --

-- 
Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

[toc] | [prev] | [standalone]

Back to top | Article view | comp.databases.ms-sqlserver

csiph-web