Preventing SQL injection with stored procedures
Posted Sep 27, 2007 18:50 UTC (Thu) by einhverfr
In reply to: Preventing SQL injection with stored procedures
Parent article: SQL injection vulnerabilities in PostgreSQL
I know this is an old post, but there is one area where this can make a difference.
The stored procedure idea does not prevent sql injection. However, in combination with appropriate db permissions it could be used to arbitrarily restrict what a user can do in the database. If the db is locked down well enough, and all access is through stored procs, and if you use db native accounts, you may not have to worry about sql injection attacks in the application in the same way you would otherwise.
There are, however, two big caveat to this issue. If user-supplied input is used to create the stored procedure name, this could be exploitable as well. The second is that not all queries are parameterizable inside stored procedures on all databases. Hence you could have SQL injection *inside* your stored procedures. In some cases, you have just moved the issues of SQL injection tracking back into the stored procs.
to post comments)