保护 Oracle 数据库免受 SQL 注入

Question

I'm on Symfony and I don't know how protect my database against sql injection. If you have some idea, I will be gratefull.

My function with sql :

  public function getResult($$value)
    {
        $sql = "SELECT SOMETHING FROM SOMETHING smt
                WHERE smt.THING = '".$value."'";

        return $this->egee->executeQuery($sql);

    }

And here is my executeQuery funciton :

   public function executeQuery($sql) {

        $entityManager = $this->em->getConnection('xxx');

        $stmt = $entityManager->prepare($sql);

        $stmt->execute();

       return $stmt->fetch();
    }

I allready try with BindParam, but it's didn't work with Oracle. With BindParam I have this response :

Error 503 : Service Unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Answer 1

Here's how you do it ... with any and every database: parameterized queries.

Your SQL string now becomes:

SELECT SOMETHING FROM SOMETHING smt WHERE smt.THING = ?

Notice the ? (which is not in quotes ... this is not a one-character literal string) This indicates a query parameter.

Now, each time you execute the query, you supply an array() containing each of the parameter-values you want to substitute, in order left-to-right. Different values may be used each time the query is executed (without re-preparing it) , because these values are not "part of" the query: they are inputs.

No matter what the parameter-value contains, the database engine will never see it as anything other than the numeric or string value that it is. It will never regard it as "part of the SQL." Thus, SQL-injection becomes impossible.

Furthermore, the [binary] value is used directly, instead of being decoded from a character string. So, say, if you want to use quote-marks as part of your string parameter-value, you would not "encode" them with backslashes. (If you provided \\" , then "a backslash followed by a quote mark" is what SQL would see as the parameter's value ... a perfectly acceptable two-character value.)

Here's a nice write-up:https://www.w3schools.com/php/php_mysql_prepared_statements.asp

Answer 2

The documentation for Doctrine ORM in the Symfony manual shows an example of using a query parameter:

https://symfony.com/doc/current/doctrine.html#querying-with-sql

$sql = '
    SELECT * FROM product p
    WHERE p.price > :price
    ORDER BY p.price ASC
    ';
$stmt = $conn->prepare($sql);
$stmt->execute(['price' => $price]);

You don't need to use BindParam. Just pass a hash array to execute() , where the hash keys are the named query parameter placeholders you put in your SQL query.