我的用户能注入我的动态sql吗?

我是一名为内部用户编写的桌面开发人员,因此我不担心恶意黑客,但我想知道他们在更新服务器上执行sql的值时是否可以输入任何内容。

业务定义了他们的内容模式,我为他们提供了一个CRUD应用程序,当他们的模式发生变化时,不必更改它,因为验证细节是表驱动的,更新是动态SQL。我必须在它们的数据输入中支持单引号,所以当它们输入单引号时,我会在服务器上执行SQL之前将它们加倍。然而,从我读到的情况来看,这不足以阻止注射。

基本上,我在运行时构建的SQL语句遵循以下模式:

update table set field=value其中pkField=pkVal

用这个VB.NET版代码:

Friend Function updateVal(ByVal newVal As String) As Integer
    Dim params As Collection
    Dim SQL As String
    Dim ret As Integer

    SQL = _updateSQL(newVal)
    params = New Collection
    params.Add(SQLClientAccess.instance.sqlParam("@SQL", DbType.String, 0, SQL))
    Try
        ret = SQLClientAccess.instance.execSP("usp_execSQL", params)
    Catch ex As Exception
        Throw New Exception(ex.Message)
    End Try
    Return ret
End Function

Private Function _updateSQL(ByVal newVal As String) As String
    Dim SQL As String
    Dim useDelimiter As Boolean = (_formatType = DisplaySet.formatTypes.text)
    Dim position As Integer = InStr(newVal, "'")
    Do Until position = 0
        newVal = Left(newVal, position) + Mid(newVal, position)       ' double embedded single quotes '
        position = InStr(position + 2, newVal, "'")
    Loop
    If _formatType = DisplaySet.formatTypes.memo Then
        SQL = "declare @ptrval binary(16)"
        SQL = SQL & " select @ptrval = textptr(" & _fieldName & ")"
        SQL = SQL & " from " & _updateTableName & _PKWhereClauses
        SQL = SQL & " updatetext " & _updateTableName & "." & _fieldName & " @ptrval 0 null '" & newVal & "'"
    Else
        SQL = "Update " & _updateTableName & " set " & _fieldName & " = "
        If useDelimiter Then
            SQL = SQL & "'"
        End If
        SQL = SQL & newVal
        If useDelimiter Then
            SQL = SQL & "'"
        End If
        SQL = SQL & _PKWhereClauses
    End If
    Return SQL
End Function

当我将文本字段更新为值时

Redmond';删除表OrdersTable--

它产生:

Update caseFile set notes = 'Redmond''; drop table OrdersTable--' where guardianshipID = '001168-3'

并将值更新为输入的文本值。

他们还可以输入什么来注入SQL?