sql server - Preventing SQL injection in a report generator with custom formulas -


for customers, building custom report generator, can create own reports.

the concept this: in control table, fill in content of report columns. each column can either consist of data different data sources (=tables), or of formula.

here reduced sample how looks:

column | source  | year   | account | formula ---------------------------------------------- col1   | tab1    | 2015   | sales   | (null) col2   | tab2    | 2014   | sales   | (null) col3   | formula | (null) | (null)  | ([col2]-[col1])

so col1 , col2 data tables tab1 , tab2, , col3 calculates difference.

a stored procedure creates dynamic sql, , delivers report data. resulting sql query looks this: 

select      (select sum(val) tab1 year=2015 , account='sales') col1,     (select sum(val) tab2 year=2014 , account='sales') col2,     (        (select sum(val) tab1 year=2015 , account='sales')        -         (select sum(val) tab2 year=2014 , account='sales')     ) col3 ;

in reality far more complex, because there more parameters, , i'm using coalesce(), etc.

my main headache formulas. while give users flexible tool @ hand, total vulnerable sql injections.

just wanted know if there simple way check parameter possible sql injection.

otherwise think need limit flexibility of system normal users, , "super users" access full flexible reports.

not - many injections involve comments (to comment out rest of regulare statment) check comments (-- , /*) , ; sign (end of statment).

on other side if allow users put filters - why should not write filter 1 = (select password users username = 'admin') provoke error message error converting 'reallystrongpassword' integer'?

furthermore guess performance bigger problem injection if see queries (it read tab1 , tab2 twice instead once if write 'regular').

edit: check sql codewords select, update, delete, exec ... in filter parameter, harden code / queries.


Comments

Post a Comment

Popular posts from this blog

c++ - Difference between pre and post decrement in recursive function argument -

i have following sample code used pre-decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(--c); cout << c << endl; return; } } this function give output input 4 : dp3 dp2 dp1 dp0 0 1 2 3 but when use post decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(c--); cout << c << endl; return; } } output goes in infinite loop dp4 can explain me in detail why happens ? this happens because function(c--) called same value of c , when finishes c decremented. recursively called, hence called same value no chance of return , hit stack overflow error. assume this, int x = 1, y = 0; y = x++ result y == 1 , x == 2. if y = ++x , bot x , y 2.
Read more

php - Nothing but 'run(); ' when browsing to my local project, how do I fix this? -

i added new project. made mistake in projectname.conf file in sites-available apache2, led me reinstalling apache2. after reinstalling , re-enabling projects on every page of every project .. <body> run(); </body> .. i've run composer update, restarted service, restarted pc, checked config files, tried disabling new project. there nothing in error log, , access.log: 127.0.0.1 - - [15/may/2015:01:40:47 +0200] "get / http/1.1" 304 181 "-" "mozilla/5.0 (x11; ubuntu; linux x86_64; rv:38.0) gecko/20100101 firefox/38.0" maybe i'm forgetting apache2 reinstall? don't think did different last time installed it. looks haven't setup php correctly. take @ this great guide , maybe you're forgetting link php config apache2.
Read more

php - How can I echo out this array? -

i don't know how go grabbing data in variable , put foreach loop. class tree{ private $info = array( array('name'=>'jim','state'=>'nu','company'=>'nu','phone'=>array('cell'=>'5615111111','office'=>'5611111111'),'email'=>array('primary'=>'exs@example.com','ex@there.com')), array('name'=>'joe smith','city'=>'phoenix','phone'=>'4805551111','email'=>'jsmith@some_email.com'), array('name'=>'john doe','city'=>'chandler','company'=>'doe co.','email'=>array('jdoe@gmail.com','personal'=>'email@email.com'),'phone'=>'6025550002') ); } if you're inside of class, can access private variable using $this->variablename . example, i...
Read more