Hacker News Reader

Comment by danielrm26 | Hacker News Reader

Actually, no. Stored Procedures can contain dynamic SQL, which is the actual problem, so it is quite possible to have a stored procedure with SQL Injection built into it. This would yield high-performance SQL Injection and little else.

The better answer is a parameterized query, which actually controls the inputs properly to ensure that no dynamic SQL is possible.

View on HN

SP:s was never mentioned in the post you are replying to, but ofcourse if you use dynamic SQL in them (execute immediate in Oracle) it is just as bad as doing string concatenation in other languages. Just dont do that.

It would be a silly thing to do because you keep exactly the same problem you'd have without stored procedures. Would the client you're writing rather execute something along the lines of

  SELECT sp_enroll("bob\"); DROP TABLE students; --");

  SELECT sp_enroll("bob"); DROP TABLE students; --");

At least if you grant the user only SELECT and EXECUTE privileges and define the procedures using the SECURITY DEFINER property, you could still prevent this type of damage. (This relies on the procedures to be as strict as possible or the whole scheme essentially fails.)

Reply on news.ycombinator.com