Java SQL Injection - MySQLSyntaxErrorException

Question

I am attempting to SQL inject one of my applications for a write up that I need to do for a project.

I have used the following statement:

Statement statement = conn.createStatement();
String insertTableSQL = "INSERT INTO activity (activity_name, user_id, category_id, started, completed) VALUES ('" + activityForm.getName() + "', '" + user.getId() + "', '" + category.getId() + "', '" + 0 + "', '" + 0 + "')";
System.out.println(insertTableSQL);
statement.executeUpdate(insertTableSQL);

When I then put the following into one of my form inputs (in this case the activity name input):

ActivityName'); DROP TABLE STUDENTS; --

I get the following error:

INSERT INTO activity (activity_name, patient_id, category_id, started, completed) VALUES ('ActivityName'); DROP TABLE STUDENTS; --', '1', '1', '0', '0')
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DROP TABLE STUDENTS; --', '1', '1', '0', '0')' at line 1

I cannot seem to find a way to avoid this error so I hope someone has some ideas.

I am guessing the error is occuring because of the way Statement in java works and the rest of the query being parsed.

Thanks

EDIT: I know that I should use prepared statements, I do. My application uses ORM with JPA. For university, I am just testing how SQL injection works.

I want to SQL inject it. That is the point. I am just testing. — jackabe
– jackabe, Commented Apr 5, 2018 at 18:38

Bill Karwin · Accepted Answer · 2023-09-23 21:01:06Z

3

By default, the MySQL JDBC driver does not allow one execute to run multiple SQL statements. This means the type of SQL injection test you show cannot execute. This is a good thing!

You'd have to explicitly allow multi-query when you connect to your JDBC data source, by putting allowMultiQueries=true in the JDBC URL.

See also Multiple queries executed in java in single statement

There are other types of SQL injections that don't run additional statements.

Prepared statements still don't support multi-query, even if you set allowMultiQueries=true.

edited Sep 23, 2023 at 21:01

answered Apr 5, 2018 at 18:47

Bill Karwin

567k87 gold badges709 silver badges869 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

jackabe Over a year ago

Ah I did not know that. Brilliant, Thanks!

Collectives™ on Stack Overflow

Java SQL Injection - MySQLSyntaxErrorException

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related