这是转义SQL查询参数的安全方法吗？

Question

At my work it used to be tradition to form SQL queries by unsafely concatenating parameters into the query strings. This leads, of course, to SQL injection vulnaribilities. This wasn't considered a huge issue because all of the Java software in which this happens runs on closed networks of which all users are assumed to be trusted. Also, the queries are executed from client-side applications with database access, so a user could technically execute malicious queries anyway.

Nonetheless, it's planned to support prepared statements in the new version of the database layer. In the meantime, I've written a small library on top of the existing database layer (which only supports executing a query from a SQL String, without the option for prepared statements or parameter escaping) that allows writing safe parameterized queries by escaping string parameters.

As part of this library, I've wrote the following method that escapes a String literal. I escape the same characters as PHP's addslashes function, but I try to avoid its multibyte character vulnerability by detecting supplementary (32-bit) characters:

private String escapeString(String str)
{
    List<Character> toEscape = Arrays.asList('\'', '"', '\\', '\0');

    StringBuilder result = new StringBuilder();
    for(int i = 0; i < str.length(); ++i)
    {
        char c = str.charAt(i);

        if(i < str.length() - 1 && c >= '\uD800' && c <= '\uDBFF')
        {
            char next = str.charAt(i + 1);

            if(next >= '\uDC00' && next <= '\uDFFF')
            {
                // Two-char supplementary character. Escape neither.
                result.append(c);
                result.append(next);
                ++i;
                continue;
            }
        }

        if(toEscape.contains(c))
        {
            // Special character. Add escaping \.
            result.append('\\');
        }

        // Copy character itself.
        result.append(c);
    }

    return result.toString();
}

My question is whether this method of escaping queries is secure enough (and I didn't oversee anything or made an implementation mistake). It can be assumed the input String is valid UTF-16. The DBMS's this will be used with are MySQL and Oracle.

Answer 1

如果没有ORM，准备好的语句或存储过程，我将对任何字符串SQL清理例程保持谨慎。

Answer 2

No.

Let's say you have an integer field which they input a PIN into:

"SELECT columns FROM table WHERE PIN = " + sanitizedstring

and then for input you type in: 1234 OR 1 = 1

And now your "pin" always is accepted, without any funny characters being used.

This could work for fields besides ints too (since yes, you could validate that an int input is actually an int before handing it over to the SQL.)