6

I've been looking at all three of these database libraries, and I'm wondering if they do anything to prevent SQL injection. I'm most likely going to be building a lib on top of one of them, and injection is a top concern I have in picking one. Anybody know?

Benoit
  • 76,634
  • 23
  • 210
  • 236
Brett Rossier
  • 3,420
  • 3
  • 27
  • 36

2 Answers2

5

Got with the author of the OTL library. A parameterized query written in "OTL Dialect," as I'm calling it, will be passed to the underlying DB APIs as a parameterized query. So parameterized queries would be as injection safe as the underlying APIs make them.

Go to this other SO post for his full e-mail explanation: Is C++ OTL SQL database library using parameterized queries under the hood, or string concat?

Edit: SOCI uses the soci::use expression, which translates to the usual binding mechanism, but with more syntactic sugar. Example: db_session << "insert into table(column) values(:value_placeholder)", use(user_input,"value_placeholder");

As far as DTL is concerned, I'm not sure what it do with parameters in relation to the underlying APIs.

Community
  • 1
  • 1
Brett Rossier
  • 3,420
  • 3
  • 27
  • 36
1

Generally a library at this level should just do what you tell it to. You most prevent SQL injection by looking at strings you're provided by the user, and only passing things on to the library after you've sanitized them.

Jerry Coffin
  • 476,176
  • 80
  • 629
  • 1,111
  • Well, I know it's good to always sanitize inputs to prevent injection, but I wasn't sure one way or the other on any of these libraries, as to whether they use parameters under the hood, or if they're basically just converting the variables I pass in to strings and combining them, or if maybe they convert my query to a parameterized version. Maybe I just missed something in the documentation for each, but so far I haven't seen anything to that effect. – Brett Rossier Jun 25 '10 at 14:31
  • Check string isn't enough to prevent SQL injection – danbo Apr 26 '15 at 20:08