Home/ Questions/Q 352743
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T11:45:56+00:00

Recently one of our client’s websites fell prey to a SQL Injection attack due

  • 0

Recently one of our client’s websites fell prey to a SQL Injection attack due to a failure to sanitize query string parameters provided to the page. The vulnerable code has since been identified and is being corrected, but it got me wondering about some of the differences between how MySQL and SQL Server process multi-query strings.

The vulnerable code is used on several dozen websites, two of which are are running on SQL server while the rest are on MySQL. With this code we have never before suffered an injection attack (by the grace of God), but once we released the two websites that are running on SQL server (with the same code base) the website was quickly exploited. The method of injection was quite simple:

page.asp?param=1;delete from [some_table];

Like I said, the vulnerable code is shared across many websites, but if I try to execute the same type of injection on our MySQL sites ASP throws up a nice Server Error letting us know that there was an error in the query:

SELECT * FROM Table1 WHERE ID = 1;DELETE FROM TABLE1;

Testing this further I was able to verify that the MySQL ODBC 3.51 Driver will not allow two SQL queries to be executed in the same statement when an ADODB.Connection object calls Execute(“”), while SQL Server Native Client (10.1) doesn’t have any problem running two side-by-side queries. Is this in fact just a configuration of the provider that makes SQL server vulnerable in this fashion while MySQL is not, or does this stem from somewhere else?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The MySQL client API does not permit multi-queries by default. You have to enable this explicitly, or else you’ll get errors when trying to execute a query like you saw. This is a good thing for reducing risk of SQL injection attacks.

    The MySQL ODBC driver 3.51.18 (August 2007) added support for a connect option FLAG_MULTI_STATEMENTS to enable multi-statements. See http://dev.mysql.com/doc/refman/5.1/en/connector-odbc-configuration-connection-parameters.html.

    See also http://bugs.mysql.com/bug.php?id=7445 for the history of this option.

    Also see my answer to “Mysql change delimiter for better SQL INJECTION handling?” Note that multi-statements is only one way to get an SQL injection vulnerability. Disabling multi-statements is not a 100% proof against these flaws.

    • 0