Is blocking query commands enough to prevent SQL injection? [duplicate]

Question

I'm a beginner in the field of databases, and I'm about to understand, how free text inputs for queries might be used to compromise a database via SQL injection.

Actually, the relevant xckd sums it up perfectly:

This certain comic implies that if I don't allow users to form ANY kind of input that contains SQL commands (like DROP, UPDATE, INSERT INTO, etc.) then "illegal" SQL queries can't be done.

Is there anything I miss? Or am I right?

And no, the strip is not about removing sql commands from user's input. It is about doing things right. — GSerg
– GSerg, Commented Apr 15, 2016 at 13:40

Simon · Accepted Answer · 2016-04-15 13:50:51Z

2

You don't have to ban all SQL commands from your inputs, you just need to make sure they are only ever treated as free text so that they cannot be accidentally executed as a command.

This is probably a good place to start:

https://en.wikipedia.org/wiki/SQL_injection

answered Apr 15, 2016 at 13:50

Simon

1,0819 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Is blocking query commands enough to prevent SQL injection? [duplicate]

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related