Is this Python code vulnerable to SQL injection? (SQLite3)

by

Yes, it is. Use something like this to prevent it:

cursor.execute("INSERT INTO table VALUES ?", args)

Note that you cannot enter the table in like this. Ideally the table should be hard coded, in no circumstance should it come from a user input of any kind. You can use a string similar to what you did for the table, but you’d better make 100% certain that a user can’t change it somehow… See Can I use parameters for the table name in sqlite3? for more details.

Essentially, you want to put the parameters in the cursor command, because it will make sure to make the data database safe. With your first command, it would be relatively easy to make a special table or args that put something into your SQL code that wasn’t safe. See the python pages, and the referenced http://xkcd.com/327/ . Specifically, the python pages quote:

Usually your SQL operations will need to use values from Python
variables. You shouldn’t assemble your query using Python’s string
operations because doing so is insecure; it makes your program
vulnerable to an SQL injection attack (see http://xkcd.com/327/ for
humorous example of what can go wrong).

Instead, use the DB-API’s parameter substitution. Put ? as a
placeholder wherever you want to use a value, and then provide a tuple
of values as the second argument to the cursor’s execute() method.
(Other database modules may use a different placeholder, such as %s or
:1.)

Basically, someone could set an args that executed another command, something like this:

args="name; DELETE table"

Using cursor.execute will stuff the value given, so that the argument could be as listed, and when you do a query on it, that is exactly what you will get out. XKCD explains this humorously as well.

enter image description here

More Related Contents:

  1. How can I get dict from sqlite query?
  2. Using a WHERE ___ IN ___ statement
  3. How to get a single result from a SQL query in python?
  4. pysqlite: Placeholder substitution for column or table names?
  5. What is an efficient way of inserting thousands of records into an SQLite table using Django?
  6. Python SQLite3 SQL Injection Vulnerable Code
  7. Python and SQLite: insert into table
  8. How to check the existence of a row in SQLite with Python?
  9. sqlite3.ProgrammingError: Incorrect number of bindings supplied. The current statement uses 1, and there are 74 supplied
  10. Sqlite / SQLAlchemy: how to enforce Foreign Keys?
  11. How to create a large pandas dataframe from an sql query without running out of memory?
  12. Passing table name as a parameter in psycopg2
  13. Getting the SQL from a Django QuerySet [duplicate]
  14. Python SQLite parameter substitution with wildcards in LIKE
  15. Django: Adding “NULLS LAST” to query
  16. return SQL table as JSON in python
  17. SQLite parameter substitution and quotes
  18. Mark data as sensitive in python
  19. Python SQLite: database is locked
  20. How to discover table properties from SQLAlchemy mapped object
  21. Auto Increment on Composite Primary Key – Sqlite3 + Python
  22. How to see the raw SQL queries Django is running?
  23. How to get rows which match a list of 3-tuples conditions with SQLAlchemy
  24. Dynamic SQL Queries with Python and mySQL
  25. Do CSRF attacks apply to API’s?
  26. How to upgrade sqlite 3.8.2 to >= 3.8.3
  27. How to open and convert sqlite database to pandas dataframe
  28. How to see the real SQL query in Python cursor.execute using pyodbc and MS-Access
  29. SQLite, python, unicode, and non-utf data
  30. Pycharm environment different than command line

Leave a Comment