-1

I read here that using ORM (like nHibernate) does not necessarily prevent SQL injection; for example, if you keep creating dynamic queries using your ORM framework you are still vulnerable.

Fine, then what is the proper use of ORM to avoid all types of SQL injection? Should we use Parameterized Queries using our ORM framework? Does something like nHibernate escape special SQL characters like single quote so developers do not write a piece of code like this:

private string SafeSqlLiteral(string inputSQL) { return inputSQL.Replace("'", "''"); }

Community
  • 1
Goli E
  • 895
  • 1
  • 11
  • 20

2 Answers2

2

Fine, then what is the proper use of ORM to avoid all types of SQL injection?

You don't.

ORM was not created to prevent SQL Injection. If you want to prevent SQL Injection - have a firm understanding of how SQL Injection works, and apply this knowledge to the code you write. This way - you will know the correct way to prevent it (including in cases that involve the use of dynamic SQL).

I haven't dug through NHibernate's source code so I can't tell you how they attempt to prevent SQL Injection (if you really care, I would suggest doing some digging on your own). If I had to bet - I would say they use parameterized SQL as this is the industry standard for preventing SQL Injection.

To prevent SQL Injection in dynamic sql you need to use parameterized queries, specifically sp_executesql.

Abe Miessler
  • 8,155
  • 10
  • 44
  • 72
0

It does not always prevent SQL injection, typical examples include second ordre injection in scripts or even stored procedures that uses read data from a table without parameterizing them or validationg the data.

wireghoul
  • 5,745
  • 2
  • 17
  • 26
  • This ‘second order’ thing is only an issue if you treat your values differently depending on their origins. – Gumbo Jan 27 '15 at 05:38
  • That may be the case in an ideal world Gumbo, but developers make this mistake regularly, hence it is an issue. Your statement also holds true for persistent xss, yet I don't see you jumping up and down about how persistent xss is not a vulnerability. – wireghoul Jan 27 '15 at 20:14