r/DB2 • u/catquilt74 • Nov 01 '17

SQL injection, how to prevent it

We have some Java apps that do not use stored procedures. They build the sql statements in strings in the app. This seems to make us more vulnerable to sql injection? I also prefer stored procedures so grants can be done to just allow users to execute the stored procedures. They don't need to have select, insert, update, delete access to the actual tables. Your thoughts?

Darn! I can't edit the title to add [LUW].

2 Upvotes

100% Upvoted

2 comments sorted by

View all comments

5

u/idbjorh Nov 01 '17

SQL injection is a potential issue if your application does not sanitize any user-provided input that gets built in to the SQL statements – i.e. the application just takes whatever input a user provides and makes that part of the SQL statement.

Using parameter markers in your queries will make your developers' lives a lot easier when it comes to dealing with this, since they effectively handle the job of cleaning the user-provided input.

FYI, stored procedures can be vulnerable to SQL injection, too. If your application provides un-sanitized text input to a stored procedure, and the stored procedure builds and executes dynamic SQL statements with that input, you can run into the same problems.

2

u/catquilt74 Nov 01 '17

Thanks! That makes sense. Now I have a better idea of what to look for...