动态创建表时如何避免SQL注入风险？

Question

Here is simple procedure that creates table from user provided input:

PROCEDURE `hackProcedure`(
IN tab_name VARCHAR(63))
BEGIN

IF (tab_name REGEXP '^[A-Za-z0-9 ]+$')
THEN
    SET @StB = CONCAT('CREATE TABLE tab_name
                      (id INT(10) PRIMARY KEY NOT NULL UNIQUE AUTO_INCREMENT,
                      name VARCHAR(45),
                      guid VARCHAR(36));');
    PREPARE statementB FROM @StB;
    EXECUTE statementB;
    DEALLOCATE PREPARE statementB;
ELSE
    -- SIGNAL some error;
END IF;
#END

Before creating table I check that user input contains only alfa-numeric values, so to my understanding bad person trying to do an SQL injection on this procedure can not succeed because it is not possible to comment out the rest of the query nor add other columns. Is this safe or I am missing someting?

Answer 1

Its not vulnerable because the code you've shown us uses a literal value for the table name - not the parameter. I think you wanted to do this:

CONCAT('CREATE TABLE ',  tab_name, '
                  (id INT(10) PRIMARY KEY NOT NULL UNIQUE AUTO_INCREMENT,
                  name VARCHAR(45),
                  guid VARCHAR(36));');

Now, what if I call your function with...

dummy (id INT NOT NULL); DROP TABLE mysql.users; CREATE TABLE dummy2

?

It will fail because the semi-colon and brackets wull be rejected by the regex, but this is far from a robust solution.

Adding backtick quotes around the table name (as long as they are disallowed by the regex) is a slight improvement.

 CONCAT('CREATE TABLE `',  tab_name, '`