Limit semicolon to prevent SQL injection?

Question

I saw that SQL injection strings are often constructed as follows:

' ; DROP DATABASE db  --

Therefore, if I prohibit the use of semicolons in the inputs of my applications, does this prevent a 100% SQL injection attack?

Answer 1

No, this does not prevent SQL injection attacks. Every time you dynamically create SQL, either on the client side or with EXEC inside the stored proc, you run the risk.

Parameterized queries are the preferred way to enter your query into a query.

Answer 2

( ) SQL .

, .

;, (, VARCHAR CHAR, ). SQL, / .

SQL , ( ).

Answer 3

, . SQL-. , , .

, , , ', . SQL-.

Answer 4

SQL- - , . , .

Answer 5

, . , sql - - . , regexp sql .

Answer 6

it will depend on a lot of things (requests, etc.). you should use prepared instructions for this