Question

I’m doing an audit of a system, which the developers insist is SQL injection proof. This they achieve by stripping out the single-quotes in the login form – but the code behind is not parameterized; it’s still using literal SQL like so:

username = username.Replace("'", "");
var sql = "select * from user where username = '" + username + "'";

Is this really secure? Is there another way of inserting a single quote, perhaps by using an escape character? The DB in use is Oracle 10g.

Answer 1

Have a look at the testing guide here: http://www.owasp.org/index.php/Main_Page That should give you more devious test scenarios, perhaps enough to prompt a reassessment of the SQL coding strategy 🙂