Question

I am trying to validate data before inserting them into the database(POSTGRESQL). The data corresponding to email, zip code etc are easily validated with the use of Apache Commons Validator. But in case of names I used this:

^[a-zA-Z][ a-zA-Z]{1-30}$

This prevents any special characters from being added as name, but it fails to prevent users from adding DROP or GRANT as a name. As I am using PreparedStatement, I didn’t think it was going to be a problem but it is now required that SQL keywords shouldn’t go in the db as it may lead to a Second Order SQL Injection.

I thought of using blacklisting all SQL keywords (surely, this will prevent Huge Grant from logging into our site. :P) but it seems that there are >64 keywords. Is this (Blacklist filtering data for SQL Keywords) a proper approach for preventing Second Order SQL Injection? What are my options?

I am using this code:

String sql="INSERT INTO users (username, password, name) VALUES (?,?,?);";
        try{
            conn=SomeStaticClass.createConnection();
            ps=conn.prepareStatement(sql);
            ps.setString(1, dataBean.getUsername());
            ps.setString(2, dataBean.getPassword());
            ps.setString(3, dataBean.getName());
            ps.execute();
        }catch(SQLException e){
            e.printStackTrace()
        }catch(Exception e){
            e.printStackTrace();
        }finally{
            try{
                if(ps!=null){
                    ps.close();
                }
                conn.close();
            }catch(SQLException e){
                e.printStackTrace();
            }
        }

Answer 1

Second order injection only occurs if you store the keywords in the database and then later use them in an unsafe manner. If you use prepared statements and they are properly parameterized it won’t occur. Cisco have a good summary of understanding SQL injection:

http://www.cisco.com/web/about/security/intelligence/sql_injection.html

Apart from your example of “Grant” there are also many such as IF, BY, IS, IN, TO that will occur very commonly in English language / names.