Parameterized command protection
AssigneeMicrosoft Corporation
InventorsBradley Hammond, Janaina Bueno
Life of this patent
Estimating the term…
Abstract
In a database system utilizing parameterized commands, proposed parameter values are processed prior to execution of such parameterized commands to reduce the likelihood that such commands will inject additional, unanticipated database commands. Specifically, the parameter value is modified in certain ways that reduce its likelihood of injecting additional database commands. In addition, if the proposed value is found to have certain characteristics, the parameterized command is not executed.
Claims17
A method of processing dynamically-created database commands, comprising:
- receiving a parameter value for use in a variable portion of a predefined database command;
- and
- prior to executing the predefined database command with the parameter value in the variable portion, processing the parameter value to reduce its likelihood of injecting an additional database command into the predefined database command.
One or more computer-readable media containing instructions for processing dynamically-created database commands, the instructions being executable by a computer to perform actions comprising:
- receiving a text string for use in a variable portion of a predefined database command;
- executing the predefined database command with the text string in the variable portion only if none of the following conditions are met:
- the text string is expected to be a string literal and contains one or more string delimiters;
- the text string contains one or more characters indicating comment text;
- the text string is expected to be at least part of a WHERE clause and has mismatched parentheses.
One or more computer-readable media containing instructions for processing dynamically-created database commands, the instructions being executable by a computer to perform actions comprising:
- receiving a text string for use in a variable portion of a predefined database command;
- modifying the text string to reduce its likelihood of injecting an additional database command into the predefined database command;
- and
- executing the predefined database command with the modified text string in the variable portion.
Dependencies are inferred from the claim text.