I'am working on a SQL engine and to prevent sql injection i have used sql parameters.
But on the other hand I refer the tablename from the methodparameter
it look's like this for a simple example:
public void dosomething(string tablename)
{
string query = "select productname, price from " + tablename;
...
}
Now my question: is this unsecure?
You could check this yourself, what would happen if you ran this like so:
dosomething("Product;DROP TABLE Product;--")
Which assumes a table of product. Particularly going to be a problem if your tablename parameter is coming from user input.
It is definitely unsecure if user is supplying the tablename. As best practice ,instead of constructing the statements , they can be mapped or selected based on user inputs via ifs-case etc over predefined strings in your code. This will eliminate basic sql injection attacks like Eric said .
Also ,one more layer can be introduced via OOPS tricks so that DDL,DML and DCL are clearly separated in your query engine so that even the rare sql injection attacks are eliminated.
tablename = "item; Drop table item"