Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style
by jeltz on Friday October 28, 2011 @08:19PM
(#3170625)
It is not actually prepared statements that does that, it is parametrized statements. Prepared statements is a related by mostly orthogonal concept.
Prepared statements are about caching parsing and query planning and storing queries for future use, this gains performance and convenience but not necessarily security. You can use parametrized queries without storing them as prepared queries at the server. This is what Perl DBI, libpq (the C binding for PostgreSQL) and many others do.
In PostgreSQL you can use PREPARE and EXECUTE directly instead of through the convenience functions in your driver and be vulnerable to SQL injections. E.g.
PREPARE foo (boolean) AS SELECT $1;
EXECUTE foo (pg_terminate_backend(42)));
Prepared statements are about caching parsing and query planning and storing queries for future use, this gains performance and convenience but not necessarily security. You can use parametrized queries without storing them as prepared queries at the server. This is what Perl DBI, libpq (the C binding for PostgreSQL) and many others do.
In PostgreSQL you can use PREPARE and EXECUTE directly instead of through the convenience functions in your driver and be vulnerable to SQL injections. E.g.