Replacing Single Quotes - Still SQL Injection Issue?

Posted on 2009-07-09
Last Modified: 2013-11-16
I have a quick question about SQL Injections... I want to know if replacing single quotes with extra single quotes is enough to prevent SQL Injections from QueryString-based database calls.

For example:
Assume the following on the backend:
dim id, rs
id = request("id")
id = replace(id, "'", "''")
set rs = getResults(id)

Is this secure enough to prevent malicious attacks?
Question by:Unionblitz
LVL 14

Expert Comment

ID: 24814036
LVL 75

Expert Comment

by:Aneesh Retnakaran
ID: 24814313
Hello Unionblitz,
Avoiding the use of dynamic sql prevents them, if you want to have dynamic sql, use parameterised dynamic sql



Author Comment

ID: 24814864
I'm familiar with stored procedures and parameterized SQL (PHP, etc).  I just couldn't find a way to break the replace(SQL, [single quote], [single quote][single quote]).  shru 0409 provided a link that kind of went over a way to break it (I haven't tried it yet though).

Request from site:\'; DROP Table Users; --

Server Code in main.asp:
id = request("id")
id = replace(id, "'", "''")
sql = "select * from users where id = '" & id & "';"

Apparently, that would bypass the single quote guard.

Expert Comment

ID: 24818263
Yes, backslash (escape the next character) and the use of the char() function would break that security feature.  Blacklists are not the way to go.  Seeing as you are expecting an integer, force the query to be an integer.
3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.


Author Comment

ID: 24819113
Thanks, TurboBorland... Could you please provide me with an example of the char() concept?  

Right now, I am talking strictly on Classic ASP/.NET and SQL Server.  I don't care about the insecurities of PHP and MySQL at the moment. I need a good reason to explain to my boss that replacing single quotes is not enough.

Expert Comment

ID: 24819637
Sure, let's take the example of a UNION SELECT injection being made.  Also assume that we know the table names from grabbing from INFORMATION_SCHEMA.TABLES and INFORMATION_SCHEMA.COLUMNS.
      id=1/**/UNION/**/SELECT/**/TOP/**/1/**/password/**/FROM/**/admin_table/**/where/**/login_name=char(0x556e696f6e626c69747a)--    The name inside of char() is your name, hex encoded.  It conveniently bypasses the need to use quotes.  Now, the char() function would be useful to add to your query, while the backslash would be the easiest to end your current query and execute another one (like you're example of 1\'; next query;--.

Accepted Solution

TurboBorland earned 50 total points
ID: 24819641
Sorry, that was MySQL.  Here's MS-SQL:  CHAR(85)+CHAR(110)+CHAR(105)+CHAR(111)+CHAR(110)+CHAR(98)+CHAR(108)+CHAR(105)+CHAR(116)+CHAR(122)

Author Comment

ID: 24869966
TurboBorland, could you provide me with a practical example for the MS-SQL code you provided?  Perhaps for C# and ASP.NET or classic asp?

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article describes some very basic things about SQL Server filegroups.
Entity Framework is a powerful tool to help you interact with the DataBase but still doesn't help much when we have a Stored Procedure that returns more than one resultset. The solution takes some of out-of-the-box thinking; read on!
Video by: Steve
Using examples as well as descriptions, step through each of the common simple join types, explaining differences in syntax, differences in expected outputs and showing how the queries run along with the actual outputs based upon a simple set of dem…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now