Concatenating Date Values - SQL Injection

Posted by Kyle Rozendo on Stack Overflow See other posts from Stack Overflow or by Kyle Rozendo
Published on 2010-04-12T11:39:42Z Indexed on 2010/04/12 11:43 UTC
Read the original article Hit count: 715

Filed under:

tsql

|

sql-injection

|

datetime

|

concatenation

Hi All,

We currently receive parameters of values as VARCHAR's, and then build a date from them. I am wanting to confirm that the method would stop the possibility of SQL injection from this statement:

select CONVERT(datetime, '2010' + '-' + '02' + '-' + '21' + ' ' + '15:11:38.990')

Another note is that the actual parameters being passed through to the stored proc are length bound at (4, 2, 2, 10, 12) in correspondence to the above.

Thanks a ton,

Kyle

© Stack Overflow or respective owner

Related posts about tsql

TSQL Challenge 30 - A Matrix Transposition challenge in TSQL

as seen on SQL Server Central - Search for 'SQL Server Central'
This is a matrix transposition challenge. Your job is to change the position of the numbres in a 5x5 matrix. SQL Server monitoring made easy "Keeping an eye on our many SQL Server instances is much easier with SQL Response." Mike Lile.Download a free trial of SQL Response… >>> More
Will TSQL become useless because of new ORMs? [closed]

as seen on Programmers - Search for 'Programmers'
By introducing LINQ to SQL, I found myself and my .NET developer colleagues gradually moving from TSQL to C# to create queries on the database. Entity Framework made that shift almost permanent. Now it's nearly 2 years that I use LINQ to SQL and LINQ to Entities and haven't used TSQL that much. Yesterday… >>> More
Issue Creating SQL Login for AppPoolIdentity on Windows Server 2008

as seen on Johnny Coder - Search for 'Johnny Coder'
IIS7 introduced the option to run your application pool as AppPoolIdentity. With the release of IIS7.5, AppPoolIdentity was promoted to the default option. You see this change if you’re running Windows 7 or Windows Server 2008 R2. On my Windows 7 machine, I’m able to define my Application… >>> More
The best, in the West

as seen on Simple Talk - Search for 'Simple Talk'
As many of you know, I run the SQL South West user group and we are currently in full flow preparing to stage the UK’s second SQL Saturday. The SQL Saturday spotlight is going to fall on Exeter in March 2013. We have full-day session on Friday 8th with some truly amazing speakers giving their… >>> More
Something for the weekend - Whats the most complex query?

as seen on SQL Blogcasts - Search for 'SQL Blogcasts'
Whenever I teach about SQL Server performance tuning I try can get across the message that there is no such thing as a table. Does that sound odd, well it isn't, trust me. Rather than tables you need to consider structures. You have 1. Heaps 2. Indexes (b-trees) Some people split indexes… >>> More

Related posts about sql-injection

Is this query vulnerable to sql injection?

as seen on Stack Overflow - Search for 'Stack Overflow'
$myq = sprintf("select user from table where user='%s'", $_POST["user"]); I would like to know if the above query can be exploited using SQL injection. Is there any advanced SQL injection technique that could break sprintf for this particular query? >>> More
10 Ways to Prevent or Mitigate SQL Injection Attacks

as seen on Internet.com - Search for 'Internet.com'
SQL injection attacks could allow hackers to compromise your network, access and destroy your data, and take control of your machines. >>> More
10 Ways to Prevent or Mitigate SQL Injection Attacks

as seen on Internet.com - Search for 'Internet.com'
SQL injection attacks could allow hackers to compromise your network, access and destroy your data, and take control of your machines. >>> More
Database Activity Monitoring Part 2 - SQL Injection Attacks

as seen on SQL Server Central - Search for 'SQL Server Central'
If you think through the web sites you visit on a daily basis the chances are that you will need to login to verify who you are. In most cases your username would be stored in a relational database along with all the other registered users on that web site. Hopefully your password will be encrypted… >>> More
SQL Server SQL Injection from start to end

as seen on SQL Team - Search for 'SQL Team'
SQL injection is a method by which a hacker gains access to the database server by injecting specially formatted data through the user interface input fields. In the last few years we have witnessed a huge increase in the number of reported SQL injection attacks, many of which caused a great deal… >>> More