Question

When I started to write the first SQL-Statements in my programs I felt quite comfortable with protecting myself against SQL-Injection with a very simple method that a colleague showed me. It replaced all single quotes with two single quotes.

So for example there is a searchfield in which you can enter a customername to search in the customertable. If you would enter

Peter’s Barbershop

The SELECT Statement would look like

SELECT *
FROM Customers
WHERE Customername = 'Peter''s Barbershop'

If now an attacker would insert this:

';DROP TABLE FOO; --

The statement would look like:

SELECT *
FROM Customers
WHERE Customername = ''';DROP TABLE FOO;--'

It would not drop any table, but search the customertable for the customername ‘;DROP TABLE FOO;– which, I suppose, won’t be found 😉

Now after a while of writing statements and protecting myself against SQL-Injection with this method, I read that many developers use parameterized statements, but I never read an article where “our” method was used. So definitely there is a good reason for it.

What scenarios would parameterized statements cover but our method doesn’t? What are the advantages of parameterized statements compared to our method?

Thanks
Philipp

Answer 1

The parametrized queries has more proc than the defence to sql-injection.

1. It solves problem with date & time formating & parsing.
2. You can prepare execution plan for parametrized query.
3. The sql-injection protection.

I can’t remember now for another pros :).

However the way “double every quotes” has problem with fields with limited character length.

For example:

• The page has box for “nickname” which can be 10 character long.
• The user insert “Don’t care” – the exact 10 characters.

Now if you double the quotes, the value has 11 characters and the database will “cut” it, and you got another value in db than user typed.

So I recommend the parameters.