While I tried to deflect how you perform SQL Injection attacks
against a MySQL procedure, my students requested that I post
examples of what to do to avoid SQL injection, and what not to do
to invite attacks. The best practice to avoid SQL injection
attacks is too always bind inputs to data types, and avoid
providing completely dynamic WHERE clauses.
Here’s the correct way to dynamically generate a result from a MySQL Stored Procedure:
CREATE PROCEDURE hello (IN pv_input VARCHAR(50)) BEGIN SELECT sample_id , sample_name FROM sample WHERE sample_name = pv_input; END; $$ |
A call to this hello procedure will only return the
row or rows where the pv_input value matches the
sample_name column value. Any attempt to exploit it
like the one below fails.
CALL … |
