Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 153 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Try following:

  1. go to query http://odata.stackexchange.com/stackoverflow/q/734
  2. enter abc as UserId
  3. run query
  4. you'll get this error message: Error: Invalid column name 'abc'.

Error message should say something like "got a string for UserId when expecting a number" or "can't convert 'abc' to an integer".

share|improve this question
up vote 1 down vote accepted

The only way we can improve on this is to introduce strongly typed params, at the moment they are a directly injected with a text substitution.

If we knew they were supposed to be ints then we could do something nicer, but that would make the metadata format for params more verbose. Eg ##UserId##:int. I guess we could assume any param ending with Id should be a number.

share|improve this answer
    
There are only limited number of parameter types. You could try them all out with normal sql parameter binding. Jeff Atwood had a meta post ( meta.stackexchange.com/questions/51395/… ) about possible educational aspects of Data Explorer. I think that an example of sql injection should not be one of them ;) – Juha Syrjälä May 28 '10 at 6:11
    
@Juha, we are allowing people to execute arbitrary SQL here, sql injection really is not a concern, inject away the connection to the db is running under a read-only user – waffles May 31 '10 at 9:26

You get your expected error when you quote your text ('abc'):

Error: Conversion failed when converting the varchar value 'abc' to data type int.

The token is just replaced, so the query is

...
and owneruserid = abc
...

Since abc is not quoted, it is considered to be a column name.

share|improve this answer
    
So this has built-in sql injection vulnerability? But that doesn't probably matter, since you can directly do any queries you like. – Juha Syrjälä May 27 '10 at 20:17
    
@Juha Syrjälä: Yes, sort of. You can execute this query for example: ##x## and enter Select * From posts as value for x. But as you say, you can edit the query anyway so this doesn't make a difference. – Peter Lang May 27 '10 at 20:35
    
re vulnerability, try "drop table Posts​" or "delete from Posts" or "update Posts set Score = 0" – waffles May 27 '10 at 21:45
    
    
@JonSeigel: Ah, thank you :) – Peter Lang Jan 5 '11 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .