Are sql injection attacks only a threat on a page that has a form?

Question

I know it's a simple question, but in everything I've read, I've never seen this spelled out specifically.

If you do a query on a page, do you need to worry about SQL injection attacks? Or is it only a problem when you ask the user for input?

Thanks!

Answer 1

You don't have to have user input to suffer a SQL injection attack.

Let's say you have a product page that is called using a URL such as this:

product.aspx?ID=123

And in your code you have a query constructed such as this:

string sql = "SELECT * FROM Products WHERE ID = " + Request.Querystring["ID"];

Someone could call your page with this url:

product.aspx?ID=123;DROP Table Students;

And bam, you've just been had.

In addition to ANYTHING that can be passed in via a user, querystring, post, cookie, browser variable, etc. I think it is just good practice to always use parameters, even if you have the literals in your code. For example:

if(SomeCondition)
{
    sql = "Select * from myTable where someCol = 'foo'";
}
else
{
    sql = "Select * from myTable where someCol = 'bar'";
}

this may be injection safe, but your RDBMS will cache them as two different queries. if you modiy it to this:

sql = "Select * from myTable where someCol = @myParam";
if(SomeCondition)
{
   myCommand.Parameters.Add("@myParam").value = "foo";
}
else
{
   myCommand.Parameters.Add("@myParam").value = "bar";
}

You achieve the same result but the RDBMS will only cache it as one query, substituting the parameter at runtime. I use it as a rule of thumb to ALWAYS use parameterized queries, just to keep things consistent, not to mention a slight cache improvement.