有没有办法以编程方式从 C# 语句（如 SQL 服务器上的 CREATE/ALTER DATABASE）调用而不会产生安全问题？

Question

I have an .NET application which is running the following statement using SqlCommand:

DECLARE @SQL VARCHAR(100)
SELECT @SQL = 'CREATE DATABASE ' + @DB
EXEC(@SQL)

The @DB parameter comes from user input, so obviously the application is vulnerable to something like 'X DROP DATABASE Y'. I'm sure there must be an obvious way I'm missing...

Edit: using a parametrized statement cannot work because you cannot use a parameter in CREATE DATABASE (CREATE DATABASE @DB returns a syntax error).

Answer 1

First, you should never, ever do this from a web app. Ever. Really. I'm serious. With the exception of deployment packages, the only time I've needed to execute a CREATE DATABASE is from the query analyzer in SSMS. Additionally, I'm suspicious of any code that would let a user enter a database name, and then go and create it.

Most importantly, what you've posted is not a "parameterized query." It's concatenated SQL, which is the source of SQL injection vulnerabilities. . If it were a parameterized query (or a stored proc, but I don't think you can do a CREATE DATABASE from a sproc), SQL injection would be a non-issue.

You can either use a real parametrized query ( here is a good tutorial on parametrized queries. ), or sanitize your inputs, but ADO.NET or whatever other db library will reliably handle this for you IF you properly build the command and parameter objects.

Answer 2

You probably want to specify parameters - paramaterized queries pretty much eliminate SQL injection attacks (as long as you're not concatenating strings in your receiving stored procedures).

Like I said in my comment, I hope there's an exceptionally good reason for creating databases/tables on the fly where creating rows seems to work for most everyone else.

Answer 3

Use a whitelist approach: allow only letters.