SQL injection in ORACLE insert statements

Log by kj021320 08.6.22

As we all know, ORACLE does not support multi-statement operations by using symbols.

Is SQL injection a weakness during insert?

Some time ago, I saw an access version of sqlinjection in a forum appear in the insert field. Then I went back and forth to test it several times and found it was difficult to take advantage of it.

When I conducted the DBA training today, I did the test on hand. I was surprised to see the following sqlplus record.

SQL & gt; create table inserttable (n varchar2 (100 ));

The table has been created.

SQL> insert into inserttable (n) values (select user from dual ));

One row has been created.

SQL> select * from inserttable;

N -------------------- KJ

SQL> rollback;

Rollback completed.

SQL> insert into inserttable (n) values (select a from test); insert into inserttable (n) values (select a from test) * row 1st error: ORA-01427: a single row subquery returns multiple rows

SQL> spool off

Very useful