SQL Injection Myths and Fallacies

Bill Karwin, Percona Inc.

Me
Software developer C, Java, Perl, PHP, Ruby SQL maven MySQL Consultant at Percona Author of SQL Antipatterns: Avoiding the Pitfalls of Database Programming

www.percona.com

What is SQL Injection?

SELECT * FROM Bugs WHERE bug_id = $_GET['bugid']
user input

www.percona.com

What is SQL Injection?

SELECT * FROM Bugs WHERE bug_id = 1234 OR TRUE
unintended logic

www.percona.com

Worse SQL Injection

UPDATE Accounts SET password = SHA2('$password') WHERE account_id = $account_id

www.percona.com

Worse SQL Injection

UPDATE Accounts SET password = SHA2('xyzzy'), admin=('1') WHERE account_id = 1234 OR TRUE
changes password for all accounts changes account to administrator

www.percona.com

Myths and Fallacies

MYTH FALLACY

Based on a grain of truth, but derives a wrong conclusion

Based on a false assumption, but derives a logical conclusion

www.percona.com

MYTH
SQL Injection is an old problemso I dont have to worry about it.

Myth

www.percona.com

Identity Theft
130 million credit card numbers Albert Gonzalez used SQL Injection to install his packet-sniffer code onto credit-card servers Sentenced 20 years in March 2010 Cost to victim company Heartland Payment Systems: $12.6 million
http://www.miamiherald.com/2009/08/22/1198469/from-snitch-to-cyberthief-of-the.html http://www.cio.com/article/492039/Security_Breach_Cost_Heartland_12.6_Million_So_Far

www.percona.com

Other Recent Cases

(April 2011) Sun.com and MySQL.com attacked by blind SQL Injection attack, revealing portions of the sites databases, including usernames and passwords.
http://techie-buzz.com/tech-news/mysql-com-database-compromised-sql-injection.html http://seclists.org/fulldisclosure/2011/Mar/309 http://tinkode27.baywords.com/

(April 2011) LizaMoon scareware campaign infected hundreds of thousands of websites via SQL Injection.
http://www.informationweek.com/news/security/attacks/showArticle.jhtml?articleID=229400764

www.percona.com

Experts Agree
2009 Data Breach Investigations Report, Verizon Business RISK Team
When hackers are required to work to gain access, SQL injection appears to be the uncontested technique of choice. In 2008, this type of attack ranked second in prevalence (utilized in 16 breaches) and first in the amount of records compromised (79 percent of the aggregate 285 million).
http://www.verizonbusiness.com/resources/security/reports/2009_databreach_rp.pdf

www.percona.com

MYTH
Escaping input prevents SQL injection.

Myth

www.percona.com

Escaping & Filtering

backslash escapes special characters

UPDATE Accounts SET password = SHA2('xyzzy\'), admin=(\'1') WHERE account_id = 1234

coerced to integer

www.percona.com

Escaping & Filtering Functions

<?php $password = $_POST["password"]; $password_escaped = mysql_real_escape_string($password); $id = (int) $_POST["account"]; $sql = "UPDATE Accounts SET password = SHA2({$password_escaped}) WHERE account_id = {$id}"; mysql_query($sql);

www.percona.com

Escaping & Filtering Functions

<?php $password = $_POST["password"]; $password_quoted = $pdo->quote($password); $id = filter_input(INPUT_POST, "account", FILTER_SANITIZE_NUMBER_INT); $sql = "UPDATE Accounts SET password = SHA2( {$password_quoted} ) WHERE account_id = {$id}"; $pdo->query($sql);

www.percona.com

Identifiers and Keywords

<?php $column = $_GET["order"]; $column_delimited = $pdo->FUNCTION?($column); $direction = $_GET["dir"]; $sql = "SELECT * FROM Bugs ORDER BY {$column_delimited} {$direction}"; $pdo->query($sql);
keywords get no quoting no API to support delimited identifiers

www.percona.com

MYTH
If some escaping is good, more must be better.

Myth

www.percona.com

Overkill?
<?php function sanitize($string){ $string = strip_tags($string); $string = htmlspecialchars($string); $string = trim(rtrim(ltrim($string))); $string = mysql_real_escape_string($string); return $string; } $password = sanitize( $_POST["password"] ); mysql_query("UPDATE Users SET password = '$password' WHERE user_id = $user_id");
real function from a users project

www.percona.com

FIRE EVERYTHING!!

www.percona.com

Just the One Will Do

<?php $password = mysql_real_escape_string( $_POST["password"] ); mysql_query("UPDATE Users SET password = '$password' WHERE user_id = $user_id");

www.percona.com

MYTH
I can write my own escaping function.

Myth

www.percona.com

Please Dont
addslashes() isnt good enough in a multibyte world Example:
http://example.org/login.php?account=%bf%27 OR 1=1 --

$account = addslashes($_REQUEST(account)); Function sees a single-quote (%27) and inserts backslash (%5c). Result: %bf%5c%27 OR 1=1 -single-quote valid multi-byte character in GBK:
www.percona.com

Grant Access to Any Account

Interpolating: SELECT * FROM Accounts WHERE account = '{$account}' AND password = '{$password}' Results in: SELECT * FROM Accounts WHERE account = ' ' OR 1=1 -- ' AND password = 'guess'
http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string http://bugs.mysql.com/bug.php?id=8378

www.percona.com

Solutions
Use driver-provided escaping functions:
mysql_real_escape_string() mysqli::real_escape_string() PDO::quote()

Use API functions to set the client character set:

mysql_set_charset() mysqli::set_charset()
http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html

Use UTF-8 instead of GBK, SJIS, etc. Use SQL query parameters (more on this later)
www.percona.com

MYTH
Unsafe data comes from usersif its already in the database, then its safe.

Myth

www.percona.com

Not Necessarily
$sql = "SELECT product_name FROM Products"; $prodname = $pdo->query($sql)->fetchColumn(); $sql = "SELECT * FROM Bugs WHERE MATCH(summary, description) AGAINST ('{$prodname}')";
not safe input

www.percona.com

FALLACY
Using stored procedures prevents SQL Injection.

Fallacy

www.percona.com

Static SQL in Procedures

filtering by data type is a good thing

CREATE PROCEDURE FindBugById (IN bugid INT) BEGIN SELECT * FROM Bugs WHERE bug_id = bugid; END CALL FindByBugId(1234)

www.percona.com

Dynamic SQL in Procedures

CREATE PROCEDURE BugsOrderBy (IN column_name VARCHAR(100), IN direction VARCHAR(4)) BEGIN interpolating arbitrary strings = SQL injection SET @query = CONCAT( 'SELECT * FROM Bugs ORDER BY ', column_name, ' ', direction); PREPARE stmt FROM @query; EXECUTE stmt; END CALL BugsOrderBy('date_reported', 'DESC')

www.percona.com

Worthy of TheDailyWTF
CREATE PROCEDURE QueryAnyTable (IN table_name VARCHAR(100)) BEGIN SET @query = CONCAT( 'SELECT * FROM ', table_name); PREPARE stmt FROM @query; EXECUTE stmt; END CALL QueryAnyTable( '(SELECT * FROM ...)' )
http://thedailywtf.com/Articles/For-the-Ease-of-Maintenance.aspx

www.percona.com

MYTH
Conservative SQL privileges limit the damage.

Myth

www.percona.com

Denial of Service
SELECT * FROM Bugs JOIN Bugs JOIN Bugs JOIN Bugs JOIN Bugs JOIN Bugs
100 bugs = 1 trillion rows

www.percona.com

Denial of Service
SELECT * FROM Bugs JOIN Bugs JOIN Bugs JOIN Bugs JOIN Bugs JOIN Bugs ORDER BY 1
still requires only SELECT privilege

www.percona.com

Just Asking for It

http://www.example.com/show.php? query=SELECT%20*%20FROM %20Bugs

www.percona.com

FALLACY
Its just an intranet applicationit doesnt need to be secure.

Fallacy

www.percona.com

Just Ask This Manager

www.percona.com

What Stays on the Intranet?

You could be told to give business partners access to an internal application

UPDATE Accounts SET password = SHA2('$password') WHERE account_id = $account_id

www.percona.com

What Stays on the Intranet?

Your casual code could be copied & pasted into external applications

UPDATE Accounts SET password = SHA2('$password') WHERE account_id = $account_id

UPDATE Accounts SET password = SHA2('$password') WHERE account_id = $account_id

www.percona.com

What Stays on the Intranet?

Its hard to argue for a security review or rewrite for a finished application

$$ $
UPDATE Accounts SET password = SHA2('$password') WHERE account_id = $account_id

www.percona.com

MYTH
My framework prevents SQL Injection.

Myth

www.percona.com

ORMs Allow Custom SQL

Dynamic SQL always risks SQL Injection, for example Rails ActiveRecord:
Bugs.all( :joins => "JOIN Accounts ON reported_by = account_id", ) :order => "date_reported DESC"

any custom SQL can carry SQL injection

www.percona.com

Whose Responsibility?
Security is the application developers job No database, connector, or framework can prevent SQL injection all the time

www.percona.com

FALLACY
Query parameters do quoting for you.

Fallacy

www.percona.com

Interpolating Dynamic Values

Query needs a dynamic value:

SELECT * FROM Bugs WHERE bug_id = $_GET['bugid']

user input

www.percona.com

Using a Parameter
Query parameter takes the place of a dynamic value:

SELECT * FROM Bugs WHERE bug_id = ?

parameter placeholder

www.percona.com

How the Database Parses It

SELECT expr-list *

query

FROM

simpletable

bugs bug_id

WHERE

expr

equality

= ?

parameter placeholder

www.percona.com

How the Database Executes It

SELECT expr-list *

query

FROM

simpletable

bugs bug_id

WHERE

expr

equality

= 1234

parameter value

www.percona.com

Interpolation
SELECT expr-list * bug_id query FROM simpletable bugs equality = 1234 WHERE expr OR

TRUE

SQL injection

www.percona.com

Parameterization
SELECT expr-list *

query

FROM

simpletable

bugs bug_id

WHERE

expr

equality

= 1234 OR TRUE

no parameter can change the tree

www.percona.com

Sequence of Prepare & Execute

Client Server

prepare query

send SQL parse query optimize query

convert to machinereadable form

execute query send parameters repeat with different parameters return results bind parameters execute query

www.percona.com

MYTH
Query parameters prevent SQL Injection.

Myth

www.percona.com

One Parameter = One Value

SELECT * FROM Bugs WHERE bug_id = ?

www.percona.com

Not a List of Values

SELECT * FROM Bugs WHERE bug_id IN ( ? )

www.percona.com

Not a Table Name

SELECT * FROM ? WHERE bug_id = 1234

www.percona.com

Not a Column Name

SELECT * FROM Bugs ORDER BY ?

www.percona.com

Not an SQL Keyword

SELECT * FROM Bugs ORDER BY date_reported ?

www.percona.com

Interpolation vs. Parameters

Scenario Example Value Interpolation Parameter

single value multiple values table name

1234
1234, 3456, 5678

SELECT * FROM Bugs WHERE bug_id = $id

SELECT * FROM Bugs WHERE bug_id = ?

SELECT * FROM Bugs SELECT * FROM Bugs WHERE bug_id IN ($list) WHERE bug_id IN ( ?, ?, ? ) SELECT * FROM $table WHERE bug_id = 1234 NO NO

Bugs

column name date_reported SELECT * FROM Bugs ORDER BY $column other syntax DESC

SELECT * FROM Bugs NO ORDER BY date_reported $direction

www.percona.com

Solution SOLUTION

Whitelist Maps

www.percona.com

Example SQL Injection

http://www.example.com/? order=date_reported&dir=ASC
<?php $sortorder = $_GET["order"]; $direction = $_GET["dir"]; $sql = "SELECT * FROM Bugs ORDER BY {$sortorder} {$direction}"; $stmt = $pdo->query($sql);
SQL Injection unsafe inputs

www.percona.com

Fix with a Whitelist Map

application request values SQL identifiers and keywords

<?php $sortorders = array("DEFAULT" "status" "date" $directions = array( "DEFAULT" "up" "down" => "bug_id", => "status", => "date_reported" ); => "ASC", => "ASC", => "DESC" );

www.percona.com

Map User Input to Safe SQL

<?php if (isset( $sortorders[ $_GET["order"] ])) { $sortorder = $sortorders[ $_GET["order"] ]; } else { $sortorder = $sortorders["DEFAULT"]; }

www.percona.com

Map User Input to Safe SQL

<?php $direction = $directions[ $_GET["dir"] ] $directions["DEFAULT"]; ?:
PHP 5.3 syntax

www.percona.com

Interpolate Safe SQL

http://www.example.com/?order=date&dir=up
<?php $sql = "SELECT * FROM Bugs ORDER BY {$sortorder} {$direction}"; $stmt = $pdo->query($sql);
whitelisted values

www.percona.com

Benefits of Whitelist Maps

Protects against SQL injection in cases where
escaping and parameterization doesnt help.

Decouples web interface from database schema. Uses simple, declarative technique. Works independently of any framework.

www.percona.com

FALLACY
Queries parameters hurt SQL performance.

Fallacy

www.percona.com

Simple Query
Proled Elapsed
0.004 0.003 0.002 0.001
MySQL MySQLi MySQLi Prep

PDO

0
PDO Prep

www.percona.com

Complex Query
Proled Elapsed
1.56 1.17 0.78 0.39
MySQL MySQLi MySQLi Prep PDO

0
PDO Prep

www.percona.com

MYTH
A proxy/firewall solution prevents SQL injection.

Myth

www.percona.com

Oracle Database Firewall

Reverse proxy between application and Oracle

Whitelist of known SQL queries Learns legitimate queries from application traffic Blocks unknown SQL queries Also supports Microsoft SQL Server, IBM DB2,
Sybase ASE, SQL Anywhere
http://www.oracle.com/technetwork/database/database-firewall/overview/index.html

www.percona.com

GreenSQL
Reverse proxy for MySQL, PostgreSQL, Microsoft SQL Server Detects / reports / blocks suspicious queries:

Access to sensitive tables Comments inside SQL commands Empty password An or token inside a query An SQL expression that always returns true
http://www.greensql.net/about

www.percona.com

Still not Perfect

Vipin Samar, Oracle vice president of Database Security:
Database Firewall is a good first layer of defense for databases but it won't protect you from everything,
http://www.databasejournal.com/features/oracle/article.php/3924691/article.htm

GreenSQL Architecture
GreenSQL can sometimes generate false positive and false negative errors. As a result, some legal queries may be blocked or the GreenSQL system may pass through an illegal query undetected.
http://www.greensql.net/about

www.percona.com

Limitations of Proxy Solutions

False sense of security; discourages code review Gating factor for emergency code deployment Constrains application from writing dynamic SQL Doesnt stop SQL injection in Stored Procedures

www.percona.com

FALLACY
NoSQL databases are immune to SQL injection.

Fallacy

www.percona.com

NoSQL Injection
http://www.example.com?column=password
<?php $map = new MongoCode("function() { emit(this." . $_GET["column"] . ",1); } "); $data = $db->command( array( "mapreduce" => "Users", "map" => $map ) ); any string-interpolation of untrusted content is Code Injection

www.percona.com

NoSQL Injection in the Wild

Diaspora wrote MongoDB map/reduce functions dynamically from Ruby on Rails:
def self.search(query) Person.all('$where' => "function() { return this.diaspora_handle.match(/^#{query}/i) || this.profile.first_name.match(/^#{query}/i) || this.profile.last_name.match(/^#{query}/i); }") end
did query come from a trusted source?
http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/

www.percona.com

Myths and Fallacies

I dont have to worry anymore Escaping is the fix More escaping is better I can code an escaping function Only user input is unsafe Stored procs are the fix SQL privileges are the fix My app doesnt need security Frameworks are the fix Parameters quote for you Parameters are the fix Parameters make queries slow SQL proxies are the fix NoSQL databases are the fix

there is no single silver bullet use all defenses when appropriate

www.percona.com

SQL Antipatterns

http://www.pragprog.com/titles/bksqla/
www.percona.com

Copyright 2012 Bill Karwin www.slideshare.net/billkarwin

Released under a Creative Commons 3.0 License: http://creativecommons.org/licenses/by-nc-nd/3.0/ You are free to share - to copy, distribute and transmit this work, under the following conditions:

Attribution. You must attribute this work to Bill Karwin.

Noncommercial. You may not use this work for commercial purposes.

No Derivative Works. You may not alter, transform, or build upon this work.
www.percona.com