SQL Injection

For an introduction to SQL Injection check Avoiding SQL Injection in PL/SQL from the Oracle Database Application Developer's Guide - Fundamentals and the example in The APEX Best Practices paper.

Basically you should be concerned about SQL Injection if you use dynamic SQL and an end user can manipulate the dynamic expression. In PL/SQL you can write dynamic SQL via the old DBMS_SQL or the modern Native Dynamic SQL (NDS) e.g. Execute Immediate.

In APEX you should be concerned if you allow end users to input text that is used dynamic in DML, for example a Select in a Report. If you do this then make sure you validate the input. Check for length, parentheses, comments (--, /* */) etc. or do a sanity check by validating the input against a table. If the user inputs a department name check that the department name exists.

Additional information:

• SQL Injection and Oracle, Part One by Pete Finnigan
• SQL Injection and Oracle, Part Two by Pete Finnigan
• SQL Detecting SQL Injection in Oracle by Pete Finnigan

Comments