SQL Injection from VFP

[SteveDingle]

Heya All,

Was just reading up on the issue of SQL Injection when communicating with SQL Server from inside VFP...

http://en.wikipedia.org/wiki/SQL_Injection

... I assume the proper (only?) way to deal with it is just pre-checking before submitting code. just wondering if anyone has tips/thoughts etc...

Toodles,
Steve Dingle

http://www.dsbusinesssolutions.co.uk

D&S Business Solutions Ltd

 

[Mike Lewis]

Hi Steve,

Interesting article.

Our friend Christof has written a lot about this recently, especially from a VFP perspective. He had a least one article in a recent FPA about it -- including suggestions for how to defend against it.

It'd be interesting to hear if other people have got any ideas.

Mike


__________________________________
Mike Lewis (Edinburgh, Scotland)

My Visual FoxPro site: www.ml-consult.co.uk

 

[Mike Lewis]

My mistake. It was Mike Yearwood who wrote the article I was thinking of. I don't have the reference to hand, but it should be on the Advisor site.

Mike


__________________________________
Mike Lewis (Edinburgh, Scotland)

My Visual FoxPro site: www.ml-consult.co.uk

 

[SteveDingle]

Heya Mike,

Haven't had advisor sub since I moved over here so am hopeful others will chime in.

I only just read about this subject, feel kinda bad I am behind on such a big issue

Toodles,
Steve Dingle

http://www.dsbusinesssolutions.co.uk

D&S Business Solutions Ltd

 

[SteveDingle]

Ya just saw the article. Dunno if I can justify at this point for $277 for 1 year sub (or $10 Canadian [gd&rfAmericans] ). Will think about it tho.

FWIW, I was always more a FoxTalk fan when it came to content anyway

 

[Mike Lewis]

Steve,

Dunno if I can justify at this point for $277 for 1 year sub

I shouldn't tell you this, but save your money. As of this month, the $277 only buys access to the on-line content. The printed magazine will no longer appear.

As for FoxTalk, that went down the tubes a while ago.

Although I've got a vested interest in people subscribing to these journals, I can't in all conscience advise anyone to do so.

Mike


__________________________________
Mike Lewis (Edinburgh, Scotland)

My Visual FoxPro site: www.ml-consult.co.uk

 

[SteveDingle]

Thanks Mike,

Might take a lot of work for my generic data classes but guess I need to start dealing with it some time

Toodles,
Steve Dingle

http://www.dsbusinesssolutions.co.uk

D&S Business Solutions Ltd

 

[craigber]

Hey, Steve! Long time no see.. You going to German DevCon this year?

There have been articles in the past month (sorry, I don't have references handy) that say SQL injection concerns are overrated and not something most devs need to worry about. But then, only you know your application and users so only you can determine how much concern you should have.

Craig Berntson
MCSD, Visual FoxPro MVP,

http://www.craigberntson.com

Author, CrysDev: A Developer's Guide to Integrating Crystal Reports"

 

[SteveDingle]

Heya Craig,

Re: Frankfurt... still up in the air but I'm hopeful, nothing like a good German beer.. ooh and of course the sessions are great too

Re: concerns are overrated... read that too, but I've been using the 'm.' syntax for variables for years just in case. I always try to get things to the point where I can say to the clients "well that wasn't my fault because"

Hope ta see ya in Germany!



Toodles,
Steve Dingle

http://www.dsbusinesssolutions.co.uk

D&S Business Solutions Ltd

 

[gbettle]

http://xkcd.com/327/

G.

 

[Olaf Doschke]

Hello Mike,

I'm not sure you are right with the EXECSCRIPT analogon to what SQL Server does with parameters.

Eg you can pass "O'Neil" by parameter and it won't blow something like

lcName="O'Neil"
sqlExec("select * from persons where name=?lcName")

whereas lcName="O'Neil" would break

lcName="O'Neil"
sqlExec("select * from persons where name='"+lcName+"'")

So the way it works is that lcName is passed in parallel to SQL Server and it is not simply substituted into the SQL, but SQL internally keeps statement and parameter seperated.

Bye, Olaf.

 

[Olaf Doschke]

Hi Mike,

and my point is, that sql server does not.

Bye, Olaf.

 

[Olaf Doschke]

Hi Mike,

lcName="O'Neil"
sqlExec("select * from persons where name=?lcName")

works, if you want I can make it a more verbose version.

That is, sql server does not simply print the lcName string into it to get select * from persons where name=O'Neil, which wouldn't work at all. It's working, because the way sql server handles parameters in sql statements corresponding to their variable type.

qed.

Bye, Olaf.

 

[Olaf Doschke]

Mike,

This works and cannot be injectable:

m.lcName = "O'Neill"
EXECSCRIPT("SELECT * FROM table WHERE SURNAME = ?m.lcName")

correct and the same way were my examples. So you can prevent injection by parameterized sql, which was the whole point.

Bye, Olaf.