Question

As a reaction to MySqlParameter as TableName, it seems that MySQL’s Connector/NET library doesn’t support table names from user input in the following way:

MySqlCommand cmd = new MySqlCommand("SELECT * FROM @table");
cmd.Parameters.AddWithValue("@table",TableNameFromUserInput);

So I tried to find another way, but I couldn’t find any libraries that did this for me.

When searching for how to do this manually, I couldn’t found anything that didn’t tell you to use “prepared statements” from some already defined library, no matter the language.

To my limited knowledge of SQL, I only think it’s necessary to put backticks (`) around the user input and then check the input for backticks – but I wanted to be sure.

Question

How do you protect a user specified table name from SQL-Injection when the MySQL Connector doesn’t support it?

Answer 1

Check if

TableNameFromUserInput

is an existing table, before executing the query.
That prevents other errors like “table doesnt exist” aswell.