Re:No-SQL injection in Mongo PHP
by tptacek on Tuesday March 08, 2011 @11:43PM
(#2303829)
Yeah these are great comments and all but I'm just saying that, last time I checked, you can't bind a table name as a parameter in the MySQL protocol; if your table names change at runtime based on input, you're back to concatenated queries.
[ Parent
| on HN ]
Oops, I had misunderstood. You're right. It makes no sense to bind table names as parameters, because if you do then the database really has no information from which it can generate possible query plans from.
The way that I solved that particular problem in the past is that I used a templating system to generate my SQL. User input was allowed in ifs in my templates, and as parameters for my queries, and that was it. At no point did I trust user data inside of my SQL.
> you're back to concatenated queries.
Wouldn't it be safer to use a switch statement?
In theory, it should be possible to enumerate your SQL queries ahead of time rather than ever generating one on the fly. In practice, that could be a huge pain of the O(2^n) variety, depending on the application type.