Does this open the door for SQL Injection?

Question

Setting my var:

Foo = request("Bar")

Building SQL Query:

John.Source = "SELECT ID, Name FROM dbo.USER where Name = '"&Foo&"' and ID = '1'"

I found this in someones project, does this open the door for SQLi ?

It is if "Bar" is exposed to outer world (obtains its value from user input, some other system etc). E.g. Bar = x'; delete from dbo.USER; commit -- — Dmitrii Bychenko
– Dmitrii Bychenko, Commented May 7, 2013 at 13:43
You should use a parameterized query to your database, much safer — Max
– Max, Commented May 7, 2013 at 13:55

Mutation Person · Accepted Answer · 2013-05-07 14:16:03Z

Absolutely. request("Bar") will take parameters off the Request.QueryString or the Request.Form collection.

This means that you can in theory tag the following onto the querystring:

'; delete * from dbo.USER; select * from user where name='

Which will give you a query of

SELECT ID, Name FROM dbo.USER where Name = ''; delete * from dbo.USER; select * from user where name='' and ID = '1'

As one of the commenters said, use parameterized queries instead.

If this really isn't an option then be sure to escape values obtained from the Request collection. This link may help: http://blogs.iis.net/nazim/archive/2008/04/28/filtering-sql-injection-from-classic-asp.aspx

DAC84 · Accepted Answer · 2013-05-08 08:05:11Z

Yes it is. You need to sanitise the value before inserting it into the query like that. Or use parameterised queries, which is a safer option.

2 Answers 2