Android security-SQL injection

I. databases on the android platform

Android uses lightweight sqlite as a database. For database queries, if the developer constructs an SQL statement using string connection, SQL injection is generated.

Ii. Instances

Android implements an sqlite operation class SQLiteOpenHelper. We inherit this class and then reload methods such as onCreate and onUpgrade.

DatabaseHelper. java is as follows:

package com.xiaod.sqlinj;   import android.content.Context; import android.database.sqlite.SQLiteDatabase; import android.database.sqlite.SQLiteDatabase.CursorFactory; import android.database.sqlite.SQLiteOpenHelper;   public class DatabaseHelper extends SQLiteOpenHelper { public static final String TB_NAME= "usertable" ; public static final String ID= "_id" ; public static final String USERNAME= "username" ; public static final String PASSWORD= "password" ; DatabaseHelper(Context context, String name, CursorFactory cursorFactory, int version) { super (context, name, cursorFactory, version); }   @Override public void onCreate(SQLiteDatabase db) { db.execSQL( "CREATE TABLE IF NOT EXISTS " + TB_NAME+ " (" +ID+ " INTEGER PRIMARY KEY," + USERNAME+ " VARCHAR," +PASSWORD+ " VARCHAR )" ); db.execSQL( "INSERT INTO " +TB_NAME+ "(" +USERNAME+ "," +PASSWORD+ ") VALUES" + "('admin','admin888')" ); db.execSQL( "INSERT INTO " +TB_NAME+ "(" +USERNAME+ "," +PASSWORD+ ") VALUES" + "('root','root123')" ); db.execSQL( "INSERT INTO " +TB_NAME+ "(" +USERNAME+ "," +PASSWORD+ ") VALUES" + "('xiaod','xiaodwin')" ); }   @Override public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {   }   @Override public void onOpen(SQLiteDatabase db) { super .onOpen(db);   } }

 

Add a query box and a query button to display the query result in textview.
SqlinjActivity. java is as follows:

package com.xiaod.sqlinj;   import android.app.Activity; import android.database.Cursor; import android.database.sqlite.SQLiteDatabase; import android.os.Bundle; import android.view.View; import android.view.View.OnClickListener; import android.widget.Button; import android.widget.EditText; import android.widget.TextView;   public class SqlinjActivity extends Activity { public static final String DB_NAME = "sqlinj.db" ; public static final int VERSION = 1 ; private String result = "" ; private TextView m_tv; private EditText m_et; DatabaseHelper m_dbhelper; SQLiteDatabase m_db; Button m_btnselect; /** Called when the activity is first created. */ @Override public void onCreate(Bundle savedInstanceState) { super .onCreate(savedInstanceState); setContentView(R.layout.main);   m_tv = (TextView)findViewById(R.id.tv_view); m_btnselect = (Button)findViewById(R.id.btn_select); m_et = (EditText)findViewById(R.id.et_id);   m_btnselect.setOnClickListener( new OnClickListener(){   @Override public void onClick(View arg0) { // TODO Auto-generated method stub String m_id = m_et.getText().toString(); m_tv.setText(ShowData(m_id)); }   });   m_dbhelper = new DatabaseHelper( this , DB_NAME, null , VERSION); m_db = m_dbhelper.getWritableDatabase();   }   private String ShowData(String m_id) { result = "" ; Cursor m_cursor; String m_argv[] = {m_id}; m_cursor = m_db.rawQuery( "SELECT * FROM usertable WHERE _id = '" + m_id + "'" , null ); m_cursor.moveToFirst(); while (!m_cursor.isAfterLast()){ result += "id: " + m_cursor.getInt( 0 ) + "\n" + "user: " + m_cursor.getString( 1 ) + "\n" + "pass: " + m_cursor.getString( 2 ) + "\n\n" ; m_cursor.moveToNext(); } m_cursor.close(); return result; } }

In the ShowData function, records are queried by passing the id number. In the 54-row statement, SELECT * FROM usertable WHERE _ id = uses the string connection method to construct an SQL statement. We run the program to test whether the program can be injected.

After running, submit 1 and return to normal

 

Submitting 2' and '1' = '1 returns normal

Submitting 2' and '1' = '2 cannot query data

Enter 2' or _ id <> 'to return all data.

Inject OK

Iii. protection methods

The SQL injection protection method is consistent with the conventional approach, using parameterized Query

Add an array storage query parameter and modify the query statement:

String m_argv[] = {m_id}; m_cursor = m_db.rawQuery( "SELECT * FROM usertable WHERE _id = ?" , m_argv);

Then test that sqlinj does not exist.

From http://www.sectop.com /? P = 176