Question

Is it possible to SQL inject a single query that ends with DESC or ASC where those values or pulled from a variable?

SELECT * FROM [master].[dbo].[spt_values] ORDER BY low asc

Attempts to add a semicolon and a new statement will not work as the statement is loaded directly into a record set.

We have tried semi colon new statement
and
union
etc.

Is there any way to join a dataset into the first one without nesting as the first one isn’t nested?

Edit:
The semicolon new command won’t work as it all comes back as a record set. It just throws all sorts of errors with a new command. It is being fixed currently. Just trying to show upper management that these things are not good practice.

Answer 1

Yes this is possible. Why don’t you validate the untrusted(!) input string?

Assert.IsTrue(str == "asc" || str == "desc");