pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Thomas Mueller <thomas.tom.mueller@gmail.com>
To: pgsql-sql@postgresql.org
Subject: Re: Protection from SQL injection
Date: Sun, 27 Apr 2008 11:14:11 +0200
Message-ID: <5f211bd50804270214s852989me86c61caecadb5b@mail.gmail.com> (raw)
In-Reply-To: <13885.1209268720@sss.pgh.pa.us>
References: <5f211bd50804260932l7a63618jca64858271ff269f@mail.gmail.com>
	<fv0727$cge$1@ger.gmane.org>
	<dcc563d10804261721l68d7dcd1u329d796a8aa8a9b4@mail.gmail.com>
	<13670.1209267734@sss.pgh.pa.us>
	<dcc563d10804262050u3da9f7f8n66bc30596ba63772@mail.gmail.com>
	<13885.1209268720@sss.pgh.pa.us>

Hi,

> providing a mode in which the server would reject PQexec strings containing more than one query.

That wouldn't help a lot. The simple SQL injection is not detected:

ResultSet rs = stat.executeQuery(
  "SELECT * FROM USERS WHERE PASSWORD='" + password + "'");

An attacker would only need to use the following password:

' OR 1=1

The the SQL statements is still only one query:

SELECT * FROM USERS WHERE PASSWORD='' OR 1=1

Regards,
Thomas



view thread (23+ messages)  latest in thread

Message-ID: <5f211bd50804270214s852989me86c61caecadb5b@mail.gmail.com>
Permalink:  ../5f211bd50804270214s852989me86c61caecadb5b@mail.gmail.com/
Also on:    postgresql.org/message-id/5f211bd50804270214s852989me86c61caecadb5b@mail.gmail.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: thomas.tom.mueller@gmail.com
  Subject: Re: Protection from SQL injection
  In-Reply-To: <5f211bd50804270214s852989me86c61caecadb5b@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox