Copyright 2003 (c) Alumni

SQL-injection defensively

Questa materia fu mandato a memoria del giusto movimento,

"La Resistenza" di nome, del popolo italiano contro il fascismo,

anche a quel tempo durante la seconda guerra mondiale.

I. Problem stress:

While evaluating input data which being formed intentionally, the SQL-

processor (NB: vendor criteria is omitted here) can provoke execution of

inadeqaute statement (such occurence is enlightened well by various

security anlaysis). Oddly enough, our goal is to reduce the probability of

successful attack.

II. Solution(s):

1. The 1st one and very primitive on my point of view is to organize a

collection of numeric indexation.

Thus:

<input> -> convertation -> <input = [numeric]> ~ <the index table

corresponding given index>

As you see, this works as if it would be a filter which excludes the

symbols not belonging to given set of chars.

Besides, the index corresponding can be complex, it means that several

input numbers being converted such way that result remains unique (so-

called collide prevention).

Ex:

NO_MORE_SQL_INJECTION({1,2,3},55) = 1*55^2+2*55^1+3 (the upper bound of

index is 55).

2. The next solution is based on unicode scheme. The idea is in how to

avoid, as mentioned above, `inadeqaute SQL-statement execution`. Normally,

the input string can alter processing request:

SQL: select 'A' from X;

Input: A = ' from NULL; select * from Y--

Provoked: select '' from NULL; select * from Y--' from X;

Let's filter the incoming data, converting them into unicode:

Logically it can be figured as:

[input: A] -> [UNICODE(A)] -> [SQL-processing] -> [^UNICODE(A)] -> [DATA

PROCESSOR].

Thus,

SQL: select 'A' from X;

Input: A = ' from NULL; select * from Y--

Unicode:%27%20%66%72%6F%6D%20%4E%55%4C%4C%3B%20%73%65%6C%65

%63%74%20%2A%20%66%72%6F%6D%20%59%2D%2D

Processing: select '%27%20%66%72%6F%6D%20%4E%55%4C%4C%3B%20%73%65%6C%65

%63%74%20%2A%20%66%72%6F%6D%20%59%2D%2D' from X;

Data processor: possibly, entry "' from NULL; select * from Y--" cannot be

found in table X (the light in the end - attack stopped).

Thus, the method described above can be achieved in one occassion by

providing the `black` box architecture which gives a capability from

programmers side to manipulate data transmissions in spite of vendor's

license of distribution.

I'd be glad to see more debates on this issue, that's why I've posted it

to public newsletters, so that feel free to propose critical notions.

[ reply ]