安全地为多租户数据库创建新模式

Question

So I'm creating a multi-tenant database, where each tenant will have their own schema. I'm using Java JDBC & MySQL. When a new tenant signs up, the name they assign for their group becomes the schema name.

My challenge is how to do this without having SQL injection. Apparently you can't parameterize create schema statements, like this:

create schema ?

If I allow the name in the string to just be placed at the end of that statement, I open a ginormous security hole for SQL injection. So I'm just wondering what the best approach is here.

My best guess is to have the schema names not actually be the group names, but create them through an internal process. Something along the lines of (groupId + firstThreeLettersOfName). But I'm open to ideas.

Thanks.

Answer 1

First, use a cleanup procedure. Strip all chars except for alphanumeric and underscore, and limit the lenght.

Second, wrap the name in backward apostrophes. That should give you the desired result.