1
\$\begingroup\$

I have this code, which is working correctly, but I am sure that it allows SQL injection attacks.

@app.route('/private/')
def private():
    login = request.args.get('login', default=None, type=str)

    if login is None:
        return jsonify(data='Incorrect URL')

    try:
        c, conn = cursor_connection()
        c = conn.cursor()
        c.execute("SELECT uid "
                  "FROM logins_passwords "
                  "WHERE login='{}' "
                  "".format(login)
                  )

        id = c.fetchall()
        if not id:
            return jsonify(data='Incorrect login')

        c.execute("SELECT mc_address "
                  "FROM boxes_id "
                  "WHERE uid='{}' "
                  "".format(id[0][0])
                  )
        mc_address = c.fetchall()[0][0]

        c.close()
        conn.close()
    except Exception as e:
        return str(e)

    return render_template(
        "private.html",
        id=mc_address
    )

Access is available by URL request. How can I protect it against SQL injection? If I'm right, I think that changing access method to POST can solve all problems with security here?

As far as I understand, in cases of only POST requests allowed, the attacker will have no ability to inject SQL request through a URL. How can it be possible to execute SQL requests than?

\$\endgroup\$
  • \$\begingroup\$ Switching to POST will not protect against SQL attacks (and a whole range of other attacks). \$\endgroup\$ – Daniel Jan 13 '18 at 13:40
  • \$\begingroup\$ Why not? Attacker will have no abillity to inject SQL request through URL, how can it be possible to execute SQL requests? \$\endgroup\$ – Ivan Jan 13 '18 at 13:53
  • 1
    \$\begingroup\$ I don't think the code is working correctly. It is trivial to create a POST request to your server and setting "login" parameter to the value: " not a valid user' OR '1' = '1 " You MUST do either input sanitation or do a parameterized query. \$\endgroup\$ – JanErikGunnar Jan 13 '18 at 17:03
  • \$\begingroup\$ Reading the query again, I realize that you were already aware of the vulnerability, I got confused because in my mind "working correctly" and "allows SQL injection attack" are mutually exclusive :) Though even disregarding security, it will fail if the user happens to have a username containing a single quote and some other characters. As mentioned, uou MUST do either input sanitation or do a parameterized query. \$\endgroup\$ – JanErikGunnar Jan 13 '18 at 17:10
  • \$\begingroup\$ No problem:) Can you provide a simple example based on my code so I could realize how secure SQL request should look like..? \$\endgroup\$ – Ivan Jan 13 '18 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.