SlideShare a Scribd company logo
1 of 77
Download to read offline
SQL INJECTION
MYTHS AND FALLACIES
Bill Karwin
ME
• Software developer
• C, Java, Perl, PHP, Ruby, SQL
• Author of SQL Antipatterns: 

Avoiding the Pitfalls of Database Programming
WHAT IS SQL INJECTION?
http://example.com/show.php?bugid=1234
SELECT * FROM Bugs 

WHERE bug_id = $_GET['bugid']
user input
WHAT IS SQL INJECTION?
http://example.com/show.php?bugid=1234 ORTRUE
SELECT * FROM Bugs 

WHERE bug_id = 1234 ORTRUE
unintended
logic
WORSE SQL INJECTION
http://example.com/changepass.php?acctid=1234

&pass=xyzzy
UPDATE Accounts 

SET password = SHA2('$password')

WHERE account_id = $account_id
WORSE SQL INJECTION
http://example.com/changepass.php?acctid=1234 ORTRUE

&pass=xyzzy'), admin=('1
UPDATE Accounts 

SET password = SHA2('xyzzy'), admin=('1')

WHERE account_id = 1234 ORTRUE
changes password
for all accounts
changes account to
administrator
MYTHS AND FALLACIES
Based on a grain of truth, 

but derives a wrong conclusion
Based on a false assumption, 

but derives a logical conclusion
MYTH
FALLACY
MYTH
“SQL Injection is an old
problem―so I don’t have to
worry about it.”
MYTH
ARCHOS
• Christmas 2014
• “French smartphone maker Archos was
compromised by a SQL injection attack last
Christmas, resulting in the leak of up to 100,000
customer details.”
• http://www.scmagazineuk.com/up-to-100k-archos-customers-compromised-by-sql-injection-attack/article/395642/
WORDPRESS
• February 2015
• “One Million WordPress WebsitesVulnerable to
SQL Injection Attack”
• http://www.tripwire.com/state-of-security/latest-security-news/one-million-wordpress-websites-vulnerable-to-sql-injection-attack/
DRUPAL
• March 2015
• “Drupal SQL injection vulnerability attacks
persist, despite patch release”
• http://www.scmagazine.com/trustwave-details-drupal-sql-injection-attack/article/404719/
MYTH
“Escaping input 

prevents SQL injection.”
MYTH
ESCAPING & FILTERING
http://example.com/changepass.php?acctid=1234 ORTRUE

&pass=xyzzy'), admin=('1
UPDATE Accounts 

SET password = SHA2('xyzzy'), admin=('1')

WHERE account_id = 1234
coerced to 

integer
backslash escapes
special characters
ESCAPING & FILTERING
FUNCTIONS
<?php
$password = $_POST["password"];

$password_escaped = mysqli_real_escape_string($password);
$id = (int) $_POST["account"];
$sql = "UPDATE Accounts

SET password = SHA2(‘{$password_escaped}’)

WHERE account_id = {$id}";
mysql_query($sql);
ESCAPING & FILTERING
FUNCTIONS
<?php
$password = $_POST["password"];

$password_quoted = $pdo->quote($password);
$id = filter_input(INPUT_POST, "account", 

FILTER_SANITIZE_NUMBER_INT);
$sql = "UPDATE Accounts

SET password = SHA2( {$password_quoted} )

WHERE account_id = {$id}";
$pdo->query($sql);
IDENTIFIERS AND KEYWORDS
<?php
$column = $_GET["order"];

$column_delimited = $pdo->FUNCTION?($column);
$direction = $_GET["dir"];
$sql = "SELECT * FROM Bugs

ORDER BY {$column_delimited} {$direction}";
$pdo->query($sql);
no API to support
delimited identifiers
keywords get no
quoting
MYTH
“If some escaping is good, more
must be better.”
MYTH
OVERKILL?
<?php
function sanitize($string){     

  $string = strip_tags($string); 

  $string = htmlspecialchars($string);

  $string = trim(rtrim(ltrim($string))); 

  $string = mysql_real_escape_string($string);

  return $string;

}
$password = sanitize( $_POST["password"] );
real function from 

a user’s project
“FIRE EVERYTHING!!”
JUSTTHE ONE WILL DO
<?php
$password = mysqli_real_escape_string( 

$_POST["password"] );
mysqli_query("UPDATE Users 

SET password = '$password' 

WHERE user_id = $user_id");
MYTH
“I can write my own 

escaping function.”
MYTH
PLEASE DON’T
• http://example.org/login.php?account=%bf%27 OR 'x'='x
• $account = addslashes($_REQUEST(“account”));
• addslashes() sees a single-quote (%27) and inserts
backslash (%5c). Result:

%bf%5c%27 OR 'x'='x
valid multi-byte
character in GBK: 縗
single-quote
GRANT ACCESSTO ANY
ACCOUNT
• Interpolating:
SELECT * FROM Accounts 

WHERE account = '{$account}' 

AND password = '{$passwd}'
• Results in:
SELECT * FROM Accounts 

WHERE account = '縗' OR 'x'= 'x' 

AND password = 'xyzzy'
• http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
• http://bugs.mysql.com/bug.php?id=8378
SOLUTIONS
• Use driver-provided escaping functions:
• mysqli::real_escape_string()
• PDO::quote()
• Use API functions to set the client character set:
• mysqli::set_charset()
• http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html
• Use UTF-8 instead of GBK, SJIS, etc.
MYTH
“Unsafe data comes from
users―if it’s already in the
database, then it’s safe.”
MYTH
NOT NECESSARILY
$sql = "SELECT product_name FROM Products";

$prodname = $pdo->query($sql)->fetchColumn();
$sql = "SELECT * FROM Bugs 

WHERE MATCH(summary, description) 

AGAINST ('{$prodname}')";
not safe input
FALLACY
“Using stored procedures
prevents SQL Injection.”
FALLACY
STATIC SQL IN PROCEDURES
CREATE PROCEDURE FindBugById (IN bugid INT)

BEGIN

SELECT * FROM Bugs WHERE bug_id = bugid;

END
CALL FindByBugId(1234)
filtering by data type is a
good thing
DYNAMIC SQL IN
PROCEDURES
CREATE PROCEDURE BugsOrderBy

(IN column_nameVARCHAR(100), 

IN directionVARCHAR(4))

BEGIN

SET @query = CONCAT(

'SELECT * FROM Bugs ORDER BY ', 

column_name, ' ', direction);

PREPARE stmt FROM @query;

EXECUTE stmt;

END
CALL BugsOrderBy('date_reported', 'DESC')
interpolating arbitrary strings
= SQL injection
WORTHY OFTHEDAILYWTF
CREATE PROCEDURE QueryAnyTable

(IN table_nameVARCHAR(100))

BEGIN

SET @query = CONCAT(

'SELECT * FROM ', table_name);

PREPARE stmt FROM @query;

EXECUTE stmt;

END
CALL QueryAnyTable( '(SELECT * FROM ...)' )
http://thedailywtf.com/Articles/For-the-Ease-of-Maintenance.aspx
MYTH
“Conservative SQL privileges
limit the damage.”
MYTH
DENIAL OF SERVICE
SELECT * FROM Bugs JOIN Bugs 

JOIN Bugs JOIN Bugs JOIN Bugs 

JOIN Bugs

100 bugs = 1 trillion rows
DENIAL OF SERVICE
SELECT * FROM Bugs JOIN Bugs 

JOIN Bugs JOIN Bugs JOIN Bugs 

JOIN Bugs 

ORDER BY 1
still requires only
SELECT privilege
JUST ASKING FOR IT
http://www.example.com/show.php?

query=SELECT%20*%20FROM%20Bugs
FALLACY
“It’s just an intranet
application―it doesn’t 

need to be secure.”
FALLACY
JUST ASKTHIS MANAGER
WHAT STAYS ONTHE
INTRANET?
• You could be told to give business partners access
to an internal application
UPDATE Accounts 

SET password =
SHA2('$password')

WHERE account_id =
$account_id
WHAT STAYS ONTHE
INTRANET?
• Your casual code could be copied & pasted into
external applications
UPDATE Accounts 

SET password =
SHA2('$password')

WHERE account_id =
$account_id
UPDATE Accounts 

SET password =
SHA2('$password')

WHERE account_id =
$account_id
WHAT STAYS ONTHE
INTRANET?
• It’s hard to argue for a security review or rewrite
for a “finished” application
$$$
UPDATE Accounts 

SET password =
SHA2('$password')

WHERE account_id =
$account_id
?
MYTH
“My framework 

prevents SQL Injection.”
MYTH
ORMS ALLOW CUSTOM SQL
• Dynamic SQL always risks SQL Injection, 

for example Rails ActiveRecord:
Bugs.all(

:joins => "JOIN Accounts 

ON reported_by = account_id",



:order => "date_reported DESC"

)
any custom SQL can carry
SQL injection
WHOSE RESPONSIBILITY?
• Security is the application developer’s job
• No database, connector, or framework can
prevent SQL injection all the time
FALLACY
“Query parameters do quoting
for you.”
FALLACY
INTERPOLATING DYNAMIC
VALUES
• Query needs a dynamic value:
SELECT * FROM Bugs 

WHERE bug_id = $_GET['bugid']
user input
USING A PARAMETER
• Query parameter takes the place of a dynamic
value:
SELECT * FROM Bugs 

WHERE bug_id = ?
parameter
placeholder
HOWTHE DATABASE PARSES IT
query
SELECT
FROM
WHERE
expr-list *
simple-
table
expr
bugs
parameter

placeholder
?
bug_id
=equality
HOWTHE DATABASE EXECUTES IT
query
SELECT
FROM
WHERE
expr-list *
simple-
table
expr
bugs
1234
bug_id
=
parameter

value
equality
INTERPOLATION
query
SELECT
FROM
WHERE
expr-list *
simple-
table
expr
1234
bugs
bug_id
=
TRUE
OR
SQL injection
equality
PARAMETERIZATION
query
SELECT
FROM
WHERE
expr-list *
simple-
table
expr
bugs
1234
OR
TRUE
bug_id
=
no parameter

can change the tree
equality
PREPARE & EXECUTE
Client Server
parse query
send parameters
send SQL
optimize query
execute query
return results
prepare query
execute query
repeat with 

different 

parameters
bind parameters
convert to machine-
readable form
MYTH
“Query parameters prevent
SQL Injection.”
MYTH
ONE PARAMETER = ONEVALUE
SELECT * FROM Bugs 

WHERE bug_id = ?
NOT A LIST OFVALUES
SELECT * FROM Bugs 

WHERE bug_id IN ( ? )
NOT ATABLE NAME
SELECT * FROM ? 

WHERE bug_id = 1234
NOT A COLUMN NAME
SELECT * FROM Bugs 

ORDER BY ?
NOT AN SQL KEYWORD
SELECT * FROM Bugs 

ORDER BY date_reported ?
INTERPOLATIONVS. PARAMETERS
Scenario Example Value Interpolation Parameter
single value ‘1234’
SELECT * FROM Bugs 

WHERE bug_id = $id
SELECT * FROM Bugs 

WHERE bug_id = ?
multiple
values
‘1234, 3456, 5678’
SELECT * FROM Bugs 

WHERE bug_id IN ($list)
SELECT * FROM Bugs 

WHERE bug_id IN ( ?, ?, ? )
table name ‘Bugs’
SELECT * FROM $table 

WHERE bug_id = 1234
NO
column name ‘date_reported’
SELECT * FROM Bugs 

ORDER BY $column
NO
other syntax ‘DESC’
SELECT * FROM Bugs 

ORDER BY
date_reported $direction
NO
SOLUTION
Whitelist Maps
SOLUTION
EXAMPLE SQL INJECTION
http://www.example.com/?order=date_reported&dir=ASC
<?php
$sortorder = $_GET["order"];

$direction = $_GET["dir"];
$sql = "SELECT * FROM Bugs 

ORDER BY {$sortorder} {$direction}";
$stmt = $pdo->query($sql);
unsafe inputs
SQL Injection
FIX WITH A WHITELIST MAP
<?php
$sortorders = array( "DEFAULT" => "bug_id",

"status" => "status",

"date" => "date_reported" );
$directions = array( "DEFAULT" => "ASC",

"up" => "ASC",

"down" => "DESC" );
application request
values
SQL identifiers and
keywords
MAP USER INPUTTO SAFE
SQL
<?php
$direction = $directions[ $_GET["dir"] ] ?: $directions["DEFAULT"];
INTERPOLATE SAFE SQL
http://www.example.com/?order=date&dir=up
<?php
$sql = "SELECT * FROM Bugs 

ORDER BY {$sortorder} {$direction}";
$stmt = $pdo->query($sql);
whitelisted values
BENEFITS OF WHITELIST MAPS
•Protects against SQL injection in cases where
escaping and parameterization doesn’t help.
•Decouples web interface from database schema.
•Uses simple, declarative technique.
•Works independently of any framework.
FALLACY
“Queries parameters 

hurt SQL performance.”
FALLACY
SIMPLE QUERY
Profiled Elapsed
COMPLEX QUERY
Profiled Elapsed
MYTH
“A proxy/firewall solution 

prevents SQL injection.”
MYTH
ORACLE DATABASE FIREWALL
• Reverse proxy between application and Oracle
•Whitelist of known SQL queries
•Learns legitimate queries from application traffic
•Blocks unknown SQL queries
•Also supports Microsoft SQL Server, IBM DB2, Sybase ASE,
SQL Anywhere
• http://www.oracle.com/technetwork/database/database-firewall/overview/index.html
GREENSQL
• Reverse proxy for MySQL, PostgreSQL, Microsoft SQL Server
• Detects / reports / blocks “suspicious” queries:
•Access to sensitive tables
•Comments inside SQL commands
•An ‘or’ token inside a query
•An SQL expression that always returns true
• http://www.greensql.net/about
STILL NOT PERFECT
• Vipin Samar, Oracle vice president of Database Security:
• “Database Firewall is a good first layer of defense for databases but it
won't protect you from everything,” 

http://www.databasejournal.com/features/oracle/article.php/3924691/article.htm
• GreenSQL Architecture
• “GreenSQL can sometimes generate false positive and false negative
errors.As a result, some legal queries may be blocked or the
GreenSQL system may pass through an illegal query undetected.”

http://www.greensql.net/about
LIMITATIONS OF PROXY
SOLUTIONS
•False sense of security; discourages code review
•Gating factor for emergency code deployment
•Constrains application from writing dynamic SQL
•Doesn’t stop SQL injection in Stored Procedures
FALLACY
“NoSQL databases are immune
to SQL injection.”
FALLACY
“NOSQL INJECTION”
http://www.example.com?column=password
<?php
$map = new MongoCode("function() { 

emit(this." . $_GET["column"] . ",1); 

} ");
$data = $db->command( array(

"mapreduce" => "Users",

"map" => $map

) );
any string-interpolation of
untrusted content

is Code Injection
NOSQL INJECTION INTHE
WILD
• Diaspora wrote MongoDB map/reduce functions dynamically from Ruby on Rails:
• def self.search(query)

Person.all('$where' => "function() { 

return this.diaspora_handle.match(/^#{query}/i) ||

this.profile.first_name.match(/^#{query}/i) ||

this.profile.last_name.match(/^#{query}/i); }")

end
• http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/
did query come from a
trusted source?
MYTHS AND FALLACIES
• I don’t have to worry anymore
• Escaping is the fix
• More escaping is better
• I can code an escaping function
• Only user input is unsafe
• Stored procs are the fix
• SQL privileges are the fix
• My app doesn’t need security
• Frameworks are the fix
• Parameters quote for you
• Parameters are the fix
• Parameters make queries slow
• SQL proxies are the fix
• NoSQL databases are the fix
there is no single silver bullet—

use all defenses when appropriate
SQL ANTIPATTERNS
http://www.pragprog.com/titles/bksqla/
LICENSE AND COPYRIGHT
Copyright 2010-2015 Bill Karwin
www.slideshare.net/billkarwin
Released under a Creative Commons 3.0 License: 

http://creativecommons.org/licenses/by-nc-nd/3.0/
You are free to share - to copy, distribute and 

transmit this work, under the following conditions:
Attribution. 

You must attribute this work to Bill
Karwin.
Noncommercial. 

You may not use this work for
commercial purposes.
No Derivative Works. 

You may not alter, transform, or build
upon this work.

More Related Content

What's hot

Advanced Sql Injection ENG
Advanced Sql Injection ENGAdvanced Sql Injection ENG
Advanced Sql Injection ENG
Dmitry Evteev
 
A Brief Introduction in SQL Injection
A Brief Introduction in SQL InjectionA Brief Introduction in SQL Injection
A Brief Introduction in SQL Injection
Sina Manavi
 
OWASP Top 10 Web Application Vulnerabilities
OWASP Top 10 Web Application VulnerabilitiesOWASP Top 10 Web Application Vulnerabilities
OWASP Top 10 Web Application Vulnerabilities
Software Guru
 

What's hot (20)

Sql injections - with example
Sql injections - with exampleSql injections - with example
Sql injections - with example
 
How to Use JSON in MySQL Wrong
How to Use JSON in MySQL WrongHow to Use JSON in MySQL Wrong
How to Use JSON in MySQL Wrong
 
03 Writing Control Structures, Writing with Compatible Data Types Using Expli...
03 Writing Control Structures, Writing with Compatible Data Types Using Expli...03 Writing Control Structures, Writing with Compatible Data Types Using Expli...
03 Writing Control Structures, Writing with Compatible Data Types Using Expli...
 
Garage4Hackers Ranchoddas Webcast Series - Bypassing Modern WAF's Exemplified...
Garage4Hackers Ranchoddas Webcast Series - Bypassing Modern WAF's Exemplified...Garage4Hackers Ranchoddas Webcast Series - Bypassing Modern WAF's Exemplified...
Garage4Hackers Ranchoddas Webcast Series - Bypassing Modern WAF's Exemplified...
 
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint PresentationSQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
 
Advanced SQL Injection
Advanced SQL InjectionAdvanced SQL Injection
Advanced SQL Injection
 
Sql injection in cybersecurity
Sql injection in cybersecuritySql injection in cybersecurity
Sql injection in cybersecurity
 
Load Data Fast!
Load Data Fast!Load Data Fast!
Load Data Fast!
 
Advanced Sql Injection ENG
Advanced Sql Injection ENGAdvanced Sql Injection ENG
Advanced Sql Injection ENG
 
How to Design Indexes, Really
How to Design Indexes, ReallyHow to Design Indexes, Really
How to Design Indexes, Really
 
Sql Injection - Vulnerability and Security
Sql Injection - Vulnerability and SecuritySql Injection - Vulnerability and Security
Sql Injection - Vulnerability and Security
 
SQL Injection
SQL InjectionSQL Injection
SQL Injection
 
sqlmap internals
sqlmap internalssqlmap internals
sqlmap internals
 
A Brief Introduction in SQL Injection
A Brief Introduction in SQL InjectionA Brief Introduction in SQL Injection
A Brief Introduction in SQL Injection
 
Sql injection with sqlmap
Sql injection with sqlmapSql injection with sqlmap
Sql injection with sqlmap
 
Sql injection - security testing
Sql injection - security testingSql injection - security testing
Sql injection - security testing
 
OWASP Top 10 Web Application Vulnerabilities
OWASP Top 10 Web Application VulnerabilitiesOWASP Top 10 Web Application Vulnerabilities
OWASP Top 10 Web Application Vulnerabilities
 
Sql injection
Sql injectionSql injection
Sql injection
 
XSS
XSSXSS
XSS
 
SQLite3
SQLite3SQLite3
SQLite3
 

Viewers also liked

Ppt on sql injection
Ppt on sql injectionPpt on sql injection
Ppt on sql injection
ashish20012
 

Viewers also liked (20)

SQL Injection Defense in Python
SQL Injection Defense in PythonSQL Injection Defense in Python
SQL Injection Defense in Python
 
Sql Injection attacks and prevention
Sql Injection attacks and preventionSql Injection attacks and prevention
Sql Injection attacks and prevention
 
InnoDB Locking Explained with Stick Figures
InnoDB Locking Explained with Stick FiguresInnoDB Locking Explained with Stick Figures
InnoDB Locking Explained with Stick Figures
 
SQL injection: Not Only AND 1=1 (updated)
SQL injection: Not Only AND 1=1 (updated)SQL injection: Not Only AND 1=1 (updated)
SQL injection: Not Only AND 1=1 (updated)
 
Sql injection
Sql injectionSql injection
Sql injection
 
Sql query patterns, optimized
Sql query patterns, optimizedSql query patterns, optimized
Sql query patterns, optimized
 
SQL Injection
SQL InjectionSQL Injection
SQL Injection
 
Types of sql injection attacks
Types of sql injection attacksTypes of sql injection attacks
Types of sql injection attacks
 
Ppt on sql injection
Ppt on sql injectionPpt on sql injection
Ppt on sql injection
 
Sql Antipatterns Strike Back
Sql Antipatterns Strike BackSql Antipatterns Strike Back
Sql Antipatterns Strike Back
 
Mentor Your Indexes
Mentor Your IndexesMentor Your Indexes
Mentor Your Indexes
 
Survey of Percona Toolkit
Survey of Percona ToolkitSurvey of Percona Toolkit
Survey of Percona Toolkit
 
Extensible Data Modeling
Extensible Data ModelingExtensible Data Modeling
Extensible Data Modeling
 
SQL Outer Joins for Fun and Profit
SQL Outer Joins for Fun and ProfitSQL Outer Joins for Fun and Profit
SQL Outer Joins for Fun and Profit
 
Models for hierarchical data
Models for hierarchical dataModels for hierarchical data
Models for hierarchical data
 
Schemadoc
SchemadocSchemadoc
Schemadoc
 
Requirements the Last Bottleneck
Requirements the Last BottleneckRequirements the Last Bottleneck
Requirements the Last Bottleneck
 
Percona toolkit
Percona toolkitPercona toolkit
Percona toolkit
 
MySQL 5.5 Guide to InnoDB Status
MySQL 5.5 Guide to InnoDB StatusMySQL 5.5 Guide to InnoDB Status
MySQL 5.5 Guide to InnoDB Status
 
Make profit with UI-Redressing attacks.
Make profit with UI-Redressing attacks.Make profit with UI-Redressing attacks.
Make profit with UI-Redressing attacks.
 

Similar to Sql Injection Myths and Fallacies

Top 5 Magento Secure Coding Best Practices
Top 5 Magento Secure Coding Best PracticesTop 5 Magento Secure Coding Best Practices
Top 5 Magento Secure Coding Best Practices
Oleksandr Zarichnyi
 

Similar to Sql Injection Myths and Fallacies (20)

SQL Injection Attacks
SQL Injection AttacksSQL Injection Attacks
SQL Injection Attacks
 
03. sql and other injection module v17
03. sql and other injection module v1703. sql and other injection module v17
03. sql and other injection module v17
 
Web Security - Hands-on
Web Security - Hands-onWeb Security - Hands-on
Web Security - Hands-on
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
PHP Secure Programming
PHP Secure ProgrammingPHP Secure Programming
PHP Secure Programming
 
Hacking Your Way to Better Security - PHP South Africa 2016
Hacking Your Way to Better Security - PHP South Africa 2016Hacking Your Way to Better Security - PHP South Africa 2016
Hacking Your Way to Better Security - PHP South Africa 2016
 
Hacking Your Way To Better Security - Dutch PHP Conference 2016
Hacking Your Way To Better Security - Dutch PHP Conference 2016Hacking Your Way To Better Security - Dutch PHP Conference 2016
Hacking Your Way To Better Security - Dutch PHP Conference 2016
 
Hacking Your Way To Better Security
Hacking Your Way To Better SecurityHacking Your Way To Better Security
Hacking Your Way To Better Security
 
Php Security - OWASP
Php  Security - OWASPPhp  Security - OWASP
Php Security - OWASP
 
A Brief Introduction About Sql Injection in PHP and MYSQL
A Brief Introduction About Sql Injection in PHP and MYSQLA Brief Introduction About Sql Injection in PHP and MYSQL
A Brief Introduction About Sql Injection in PHP and MYSQL
 
SQL Injection in PHP
SQL Injection in PHPSQL Injection in PHP
SQL Injection in PHP
 
Sql injection
Sql injectionSql injection
Sql injection
 
Concern of Web Application Security
Concern of Web Application SecurityConcern of Web Application Security
Concern of Web Application Security
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And Anish
 
Top 5 Magento Secure Coding Best Practices
Top 5 Magento Secure Coding Best PracticesTop 5 Magento Secure Coding Best Practices
Top 5 Magento Secure Coding Best Practices
 
Sql Injection V.2
Sql Injection V.2Sql Injection V.2
Sql Injection V.2
 
Top 10 Web Security Vulnerabilities
Top 10 Web Security VulnerabilitiesTop 10 Web Security Vulnerabilities
Top 10 Web Security Vulnerabilities
 
Advanced Topics On Sql Injection Protection
Advanced Topics On Sql Injection ProtectionAdvanced Topics On Sql Injection Protection
Advanced Topics On Sql Injection Protection
 
Unit testing with zend framework tek11
Unit testing with zend framework tek11Unit testing with zend framework tek11
Unit testing with zend framework tek11
 
Hacking Your Way To Better Security - php[tek] 2016
Hacking Your Way To Better Security - php[tek] 2016Hacking Your Way To Better Security - php[tek] 2016
Hacking Your Way To Better Security - php[tek] 2016
 

Recently uploaded

Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
panagenda
 
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider  Progress from Awareness to Implementation.pptxTales from a Passkey Provider  Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
FIDO Alliance
 

Recently uploaded (20)

AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
 
Portal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russePortal Kombat : extension du réseau de propagande russe
Portal Kombat : extension du réseau de propagande russe
 
WebAssembly is Key to Better LLM Performance
WebAssembly is Key to Better LLM PerformanceWebAssembly is Key to Better LLM Performance
WebAssembly is Key to Better LLM Performance
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
 
Frisco Automating Purchase Orders with MuleSoft IDP- May 10th, 2024.pptx.pdf
Frisco Automating Purchase Orders with MuleSoft IDP- May 10th, 2024.pptx.pdfFrisco Automating Purchase Orders with MuleSoft IDP- May 10th, 2024.pptx.pdf
Frisco Automating Purchase Orders with MuleSoft IDP- May 10th, 2024.pptx.pdf
 
Cyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptx
Cyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptxCyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptx
Cyber Insurance - RalphGilot - Embry-Riddle Aeronautical University.pptx
 
Observability Concepts EVERY Developer Should Know (DevOpsDays Seattle)
Observability Concepts EVERY Developer Should Know (DevOpsDays Seattle)Observability Concepts EVERY Developer Should Know (DevOpsDays Seattle)
Observability Concepts EVERY Developer Should Know (DevOpsDays Seattle)
 
AI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by AnitarajAI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by Anitaraj
 
JavaScript Usage Statistics 2024 - The Ultimate Guide
JavaScript Usage Statistics 2024 - The Ultimate GuideJavaScript Usage Statistics 2024 - The Ultimate Guide
JavaScript Usage Statistics 2024 - The Ultimate Guide
 
How to Check GPS Location with a Live Tracker in Pakistan
How to Check GPS Location with a Live Tracker in PakistanHow to Check GPS Location with a Live Tracker in Pakistan
How to Check GPS Location with a Live Tracker in Pakistan
 
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
TEST BANK For, Information Technology Project Management 9th Edition Kathy Sc...
 
Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...
Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...
Event-Driven Architecture Masterclass: Engineering a Robust, High-performance...
 
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
Easier, Faster, and More Powerful – Alles Neu macht der Mai -Wir durchleuchte...
 
The Zero-ETL Approach: Enhancing Data Agility and Insight
The Zero-ETL Approach: Enhancing Data Agility and InsightThe Zero-ETL Approach: Enhancing Data Agility and Insight
The Zero-ETL Approach: Enhancing Data Agility and Insight
 
ChatGPT and Beyond - Elevating DevOps Productivity
ChatGPT and Beyond - Elevating DevOps ProductivityChatGPT and Beyond - Elevating DevOps Productivity
ChatGPT and Beyond - Elevating DevOps Productivity
 
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on ThanabotsContinuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
 
AI mind or machine power point presentation
AI mind or machine power point presentationAI mind or machine power point presentation
AI mind or machine power point presentation
 
Design and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data ScienceDesign and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data Science
 
Oauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoftOauth 2.0 Introduction and Flows with MuleSoft
Oauth 2.0 Introduction and Flows with MuleSoft
 
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider  Progress from Awareness to Implementation.pptxTales from a Passkey Provider  Progress from Awareness to Implementation.pptx
Tales from a Passkey Provider Progress from Awareness to Implementation.pptx
 

Sql Injection Myths and Fallacies

  • 1. SQL INJECTION MYTHS AND FALLACIES Bill Karwin
  • 2. ME • Software developer • C, Java, Perl, PHP, Ruby, SQL • Author of SQL Antipatterns: 
 Avoiding the Pitfalls of Database Programming
  • 3. WHAT IS SQL INJECTION? http://example.com/show.php?bugid=1234 SELECT * FROM Bugs 
 WHERE bug_id = $_GET['bugid'] user input
  • 4. WHAT IS SQL INJECTION? http://example.com/show.php?bugid=1234 ORTRUE SELECT * FROM Bugs 
 WHERE bug_id = 1234 ORTRUE unintended logic
  • 5. WORSE SQL INJECTION http://example.com/changepass.php?acctid=1234
 &pass=xyzzy UPDATE Accounts 
 SET password = SHA2('$password')
 WHERE account_id = $account_id
  • 6. WORSE SQL INJECTION http://example.com/changepass.php?acctid=1234 ORTRUE
 &pass=xyzzy'), admin=('1 UPDATE Accounts 
 SET password = SHA2('xyzzy'), admin=('1')
 WHERE account_id = 1234 ORTRUE changes password for all accounts changes account to administrator
  • 7. MYTHS AND FALLACIES Based on a grain of truth, 
 but derives a wrong conclusion Based on a false assumption, 
 but derives a logical conclusion MYTH FALLACY
  • 8. MYTH “SQL Injection is an old problem―so I don’t have to worry about it.” MYTH
  • 9. ARCHOS • Christmas 2014 • “French smartphone maker Archos was compromised by a SQL injection attack last Christmas, resulting in the leak of up to 100,000 customer details.” • http://www.scmagazineuk.com/up-to-100k-archos-customers-compromised-by-sql-injection-attack/article/395642/
  • 10. WORDPRESS • February 2015 • “One Million WordPress WebsitesVulnerable to SQL Injection Attack” • http://www.tripwire.com/state-of-security/latest-security-news/one-million-wordpress-websites-vulnerable-to-sql-injection-attack/
  • 11. DRUPAL • March 2015 • “Drupal SQL injection vulnerability attacks persist, despite patch release” • http://www.scmagazine.com/trustwave-details-drupal-sql-injection-attack/article/404719/
  • 12. MYTH “Escaping input 
 prevents SQL injection.” MYTH
  • 13. ESCAPING & FILTERING http://example.com/changepass.php?acctid=1234 ORTRUE
 &pass=xyzzy'), admin=('1 UPDATE Accounts 
 SET password = SHA2('xyzzy'), admin=('1')
 WHERE account_id = 1234 coerced to 
 integer backslash escapes special characters
  • 14. ESCAPING & FILTERING FUNCTIONS <?php $password = $_POST["password"];
 $password_escaped = mysqli_real_escape_string($password); $id = (int) $_POST["account"]; $sql = "UPDATE Accounts
 SET password = SHA2(‘{$password_escaped}’)
 WHERE account_id = {$id}"; mysql_query($sql);
  • 15. ESCAPING & FILTERING FUNCTIONS <?php $password = $_POST["password"];
 $password_quoted = $pdo->quote($password); $id = filter_input(INPUT_POST, "account", 
 FILTER_SANITIZE_NUMBER_INT); $sql = "UPDATE Accounts
 SET password = SHA2( {$password_quoted} )
 WHERE account_id = {$id}"; $pdo->query($sql);
  • 16. IDENTIFIERS AND KEYWORDS <?php $column = $_GET["order"];
 $column_delimited = $pdo->FUNCTION?($column); $direction = $_GET["dir"]; $sql = "SELECT * FROM Bugs
 ORDER BY {$column_delimited} {$direction}"; $pdo->query($sql); no API to support delimited identifiers keywords get no quoting
  • 17. MYTH “If some escaping is good, more must be better.” MYTH
  • 18. OVERKILL? <?php function sanitize($string){     
   $string = strip_tags($string); 
   $string = htmlspecialchars($string);
   $string = trim(rtrim(ltrim($string))); 
   $string = mysql_real_escape_string($string);
   return $string;
 } $password = sanitize( $_POST["password"] ); real function from 
 a user’s project
  • 20. JUSTTHE ONE WILL DO <?php $password = mysqli_real_escape_string( 
 $_POST["password"] ); mysqli_query("UPDATE Users 
 SET password = '$password' 
 WHERE user_id = $user_id");
  • 21. MYTH “I can write my own 
 escaping function.” MYTH
  • 22. PLEASE DON’T • http://example.org/login.php?account=%bf%27 OR 'x'='x • $account = addslashes($_REQUEST(“account”)); • addslashes() sees a single-quote (%27) and inserts backslash (%5c). Result:
 %bf%5c%27 OR 'x'='x valid multi-byte character in GBK: 縗 single-quote
  • 23. GRANT ACCESSTO ANY ACCOUNT • Interpolating: SELECT * FROM Accounts 
 WHERE account = '{$account}' 
 AND password = '{$passwd}' • Results in: SELECT * FROM Accounts 
 WHERE account = '縗' OR 'x'= 'x' 
 AND password = 'xyzzy' • http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string • http://bugs.mysql.com/bug.php?id=8378
  • 24. SOLUTIONS • Use driver-provided escaping functions: • mysqli::real_escape_string() • PDO::quote() • Use API functions to set the client character set: • mysqli::set_charset() • http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html • Use UTF-8 instead of GBK, SJIS, etc.
  • 25. MYTH “Unsafe data comes from users―if it’s already in the database, then it’s safe.” MYTH
  • 26. NOT NECESSARILY $sql = "SELECT product_name FROM Products";
 $prodname = $pdo->query($sql)->fetchColumn(); $sql = "SELECT * FROM Bugs 
 WHERE MATCH(summary, description) 
 AGAINST ('{$prodname}')"; not safe input
  • 27. FALLACY “Using stored procedures prevents SQL Injection.” FALLACY
  • 28. STATIC SQL IN PROCEDURES CREATE PROCEDURE FindBugById (IN bugid INT)
 BEGIN
 SELECT * FROM Bugs WHERE bug_id = bugid;
 END CALL FindByBugId(1234) filtering by data type is a good thing
  • 29. DYNAMIC SQL IN PROCEDURES CREATE PROCEDURE BugsOrderBy
 (IN column_nameVARCHAR(100), 
 IN directionVARCHAR(4))
 BEGIN
 SET @query = CONCAT(
 'SELECT * FROM Bugs ORDER BY ', 
 column_name, ' ', direction);
 PREPARE stmt FROM @query;
 EXECUTE stmt;
 END CALL BugsOrderBy('date_reported', 'DESC') interpolating arbitrary strings = SQL injection
  • 30. WORTHY OFTHEDAILYWTF CREATE PROCEDURE QueryAnyTable
 (IN table_nameVARCHAR(100))
 BEGIN
 SET @query = CONCAT(
 'SELECT * FROM ', table_name);
 PREPARE stmt FROM @query;
 EXECUTE stmt;
 END CALL QueryAnyTable( '(SELECT * FROM ...)' ) http://thedailywtf.com/Articles/For-the-Ease-of-Maintenance.aspx
  • 32. DENIAL OF SERVICE SELECT * FROM Bugs JOIN Bugs 
 JOIN Bugs JOIN Bugs JOIN Bugs 
 JOIN Bugs
 100 bugs = 1 trillion rows
  • 33. DENIAL OF SERVICE SELECT * FROM Bugs JOIN Bugs 
 JOIN Bugs JOIN Bugs JOIN Bugs 
 JOIN Bugs 
 ORDER BY 1 still requires only SELECT privilege
  • 34. JUST ASKING FOR IT http://www.example.com/show.php?
 query=SELECT%20*%20FROM%20Bugs
  • 35. FALLACY “It’s just an intranet application―it doesn’t 
 need to be secure.” FALLACY
  • 37. WHAT STAYS ONTHE INTRANET? • You could be told to give business partners access to an internal application UPDATE Accounts 
 SET password = SHA2('$password')
 WHERE account_id = $account_id
  • 38. WHAT STAYS ONTHE INTRANET? • Your casual code could be copied & pasted into external applications UPDATE Accounts 
 SET password = SHA2('$password')
 WHERE account_id = $account_id UPDATE Accounts 
 SET password = SHA2('$password')
 WHERE account_id = $account_id
  • 39. WHAT STAYS ONTHE INTRANET? • It’s hard to argue for a security review or rewrite for a “finished” application $$$ UPDATE Accounts 
 SET password = SHA2('$password')
 WHERE account_id = $account_id ?
  • 40. MYTH “My framework 
 prevents SQL Injection.” MYTH
  • 41. ORMS ALLOW CUSTOM SQL • Dynamic SQL always risks SQL Injection, 
 for example Rails ActiveRecord: Bugs.all(
 :joins => "JOIN Accounts 
 ON reported_by = account_id",
 
 :order => "date_reported DESC"
 ) any custom SQL can carry SQL injection
  • 42. WHOSE RESPONSIBILITY? • Security is the application developer’s job • No database, connector, or framework can prevent SQL injection all the time
  • 43. FALLACY “Query parameters do quoting for you.” FALLACY
  • 44. INTERPOLATING DYNAMIC VALUES • Query needs a dynamic value: SELECT * FROM Bugs 
 WHERE bug_id = $_GET['bugid'] user input
  • 45. USING A PARAMETER • Query parameter takes the place of a dynamic value: SELECT * FROM Bugs 
 WHERE bug_id = ? parameter placeholder
  • 46. HOWTHE DATABASE PARSES IT query SELECT FROM WHERE expr-list * simple- table expr bugs parameter
 placeholder ? bug_id =equality
  • 47. HOWTHE DATABASE EXECUTES IT query SELECT FROM WHERE expr-list * simple- table expr bugs 1234 bug_id = parameter
 value equality
  • 50. PREPARE & EXECUTE Client Server parse query send parameters send SQL optimize query execute query return results prepare query execute query repeat with 
 different 
 parameters bind parameters convert to machine- readable form
  • 52. ONE PARAMETER = ONEVALUE SELECT * FROM Bugs 
 WHERE bug_id = ?
  • 53. NOT A LIST OFVALUES SELECT * FROM Bugs 
 WHERE bug_id IN ( ? )
  • 54. NOT ATABLE NAME SELECT * FROM ? 
 WHERE bug_id = 1234
  • 55. NOT A COLUMN NAME SELECT * FROM Bugs 
 ORDER BY ?
  • 56. NOT AN SQL KEYWORD SELECT * FROM Bugs 
 ORDER BY date_reported ?
  • 57. INTERPOLATIONVS. PARAMETERS Scenario Example Value Interpolation Parameter single value ‘1234’ SELECT * FROM Bugs 
 WHERE bug_id = $id SELECT * FROM Bugs 
 WHERE bug_id = ? multiple values ‘1234, 3456, 5678’ SELECT * FROM Bugs 
 WHERE bug_id IN ($list) SELECT * FROM Bugs 
 WHERE bug_id IN ( ?, ?, ? ) table name ‘Bugs’ SELECT * FROM $table 
 WHERE bug_id = 1234 NO column name ‘date_reported’ SELECT * FROM Bugs 
 ORDER BY $column NO other syntax ‘DESC’ SELECT * FROM Bugs 
 ORDER BY date_reported $direction NO
  • 59. EXAMPLE SQL INJECTION http://www.example.com/?order=date_reported&dir=ASC <?php $sortorder = $_GET["order"];
 $direction = $_GET["dir"]; $sql = "SELECT * FROM Bugs 
 ORDER BY {$sortorder} {$direction}"; $stmt = $pdo->query($sql); unsafe inputs SQL Injection
  • 60. FIX WITH A WHITELIST MAP <?php $sortorders = array( "DEFAULT" => "bug_id",
 "status" => "status",
 "date" => "date_reported" ); $directions = array( "DEFAULT" => "ASC",
 "up" => "ASC",
 "down" => "DESC" ); application request values SQL identifiers and keywords
  • 61. MAP USER INPUTTO SAFE SQL <?php $direction = $directions[ $_GET["dir"] ] ?: $directions["DEFAULT"];
  • 62. INTERPOLATE SAFE SQL http://www.example.com/?order=date&dir=up <?php $sql = "SELECT * FROM Bugs 
 ORDER BY {$sortorder} {$direction}"; $stmt = $pdo->query($sql); whitelisted values
  • 63. BENEFITS OF WHITELIST MAPS •Protects against SQL injection in cases where escaping and parameterization doesn’t help. •Decouples web interface from database schema. •Uses simple, declarative technique. •Works independently of any framework.
  • 64. FALLACY “Queries parameters 
 hurt SQL performance.” FALLACY
  • 67. MYTH “A proxy/firewall solution 
 prevents SQL injection.” MYTH
  • 68. ORACLE DATABASE FIREWALL • Reverse proxy between application and Oracle •Whitelist of known SQL queries •Learns legitimate queries from application traffic •Blocks unknown SQL queries •Also supports Microsoft SQL Server, IBM DB2, Sybase ASE, SQL Anywhere • http://www.oracle.com/technetwork/database/database-firewall/overview/index.html
  • 69. GREENSQL • Reverse proxy for MySQL, PostgreSQL, Microsoft SQL Server • Detects / reports / blocks “suspicious” queries: •Access to sensitive tables •Comments inside SQL commands •An ‘or’ token inside a query •An SQL expression that always returns true • http://www.greensql.net/about
  • 70. STILL NOT PERFECT • Vipin Samar, Oracle vice president of Database Security: • “Database Firewall is a good first layer of defense for databases but it won't protect you from everything,” 
 http://www.databasejournal.com/features/oracle/article.php/3924691/article.htm • GreenSQL Architecture • “GreenSQL can sometimes generate false positive and false negative errors.As a result, some legal queries may be blocked or the GreenSQL system may pass through an illegal query undetected.”
 http://www.greensql.net/about
  • 71. LIMITATIONS OF PROXY SOLUTIONS •False sense of security; discourages code review •Gating factor for emergency code deployment •Constrains application from writing dynamic SQL •Doesn’t stop SQL injection in Stored Procedures
  • 72. FALLACY “NoSQL databases are immune to SQL injection.” FALLACY
  • 73. “NOSQL INJECTION” http://www.example.com?column=password <?php $map = new MongoCode("function() { 
 emit(this." . $_GET["column"] . ",1); 
 } "); $data = $db->command( array(
 "mapreduce" => "Users",
 "map" => $map
 ) ); any string-interpolation of untrusted content
 is Code Injection
  • 74. NOSQL INJECTION INTHE WILD • Diaspora wrote MongoDB map/reduce functions dynamically from Ruby on Rails: • def self.search(query)
 Person.all('$where' => "function() { 
 return this.diaspora_handle.match(/^#{query}/i) ||
 this.profile.first_name.match(/^#{query}/i) ||
 this.profile.last_name.match(/^#{query}/i); }")
 end • http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/ did query come from a trusted source?
  • 75. MYTHS AND FALLACIES • I don’t have to worry anymore • Escaping is the fix • More escaping is better • I can code an escaping function • Only user input is unsafe • Stored procs are the fix • SQL privileges are the fix • My app doesn’t need security • Frameworks are the fix • Parameters quote for you • Parameters are the fix • Parameters make queries slow • SQL proxies are the fix • NoSQL databases are the fix there is no single silver bullet—
 use all defenses when appropriate
  • 77. LICENSE AND COPYRIGHT Copyright 2010-2015 Bill Karwin www.slideshare.net/billkarwin Released under a Creative Commons 3.0 License: 
 http://creativecommons.org/licenses/by-nc-nd/3.0/ You are free to share - to copy, distribute and 
 transmit this work, under the following conditions: Attribution. 
 You must attribute this work to Bill Karwin. Noncommercial. 
 You may not use this work for commercial purposes. No Derivative Works. 
 You may not alter, transform, or build upon this work.