MySQL Table name Injection in JAVA

Question

I have necessity to generate tables in database in runtime.
I can't use preparedStatement in this case.

I tried to find a library to validate query or tableName input for MySQL but found only ESAPI which can only escape my String. I have my custom validator for It but I know that I can't be sure in this case.

I read up many examples how to abuse SQL Injection. But usually the resources give examples for parameters, not for table name. And as I understand It is possible in case when parameter is in the end of query.

Question 1:Could you give an example how to abuse these queries?

"CREATE TABLE " + tableName + "(id int primary key)"

or

"DROP TABLE " + tableName

tableName - input from a client

It can be very usefull for testing my validator. When I try to do It I have always SQL Syntax error.

Question 2: Usually they use the tactic when it's needed to use some character as ,' or something like this and after they write their request. For this tactic it's needed to use spaces.

Is it possible to paste SQL Injection in input which can't have spaces? have only letters? Could underscore be as character which interrupt the query?

UPDATE:

If It wouuld be safe to add escape-char before underscore in "firstname_lastname" ?

Not sure but maybe something like "CREATE TABLE " + "test(id int primary key) ; delete * from user; create table test2 " + "(id int primary key)" — Scary Wombat
– Scary Wombat, Commented Mar 13, 2019 at 1:19
This describes the permitted characters in schema object names (like table names). If your validator ensures that your tableName follows the rules (preferably for unquoted names) it should be safe. — Michael Butscher
– Michael Butscher, Commented Mar 13, 2019 at 1:25
You can quote the table name like below: "CREATE TABLE `" + tableName + "` (id int primary key)". — PeterHe
– PeterHe, Commented Mar 13, 2019 at 13:45
@PeterHe That works in many cases — but a clever attacker will input a tableName string that includes a back-tick. — Bill Karwin
– Bill Karwin, Commented Mar 13, 2019 at 15:21

Kramer · Accepted Answer · 2019-03-13 01:41:45Z

1

I'd recommend against doing this, but if you have to, Michael Butscher's comment is pretty good. You can get around spaces by using something like tabs or %00 %09 /**/ %0d %0a depending on the database implementation.

answered Mar 13, 2019 at 1:41

Kramer

264 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Donatello Over a year ago

Indeed I am eager to permit only lower_cases_english_characters_and_underscores_only_between_them and use simple regex to validate It but I am not experienced in this question

Collectives™ on Stack Overflow

MySQL Table name Injection in JAVA

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related