replaceAll quotes with backslashed quotes — Is that enough?

I'm using replaceAll to replace single quotes with "\\\\'" per a colleague's suggestion, but I'm pretty sure that's not enough to prevent all SQL injections.

I did some googling and found this: http://wiki.postgresql.org/wiki/8.1.4_et._al._Security_Release_Technical_Info

This explains it for PostgreSQL, but does the replacing not work for all SQL managers? (Like, MySQL, for example?)

Also, I think I understand how the explanation I linked works for single backslash, but does it extend to my situation where I'm using four backslashes?

Please note that I'm not very familiar with databases and how they parse input, but this is my chance to learn more! Any insight would be appreciated.

Edit: I've gotten some really helpful, useful answers. My next question is, what kind of input would break my implementation? That is, if you give me input and I prepend all single quotes with four backslashes, what kind of input would you give me to inject SQL code? While I am convinced that my approach is naive and wrong, maybe some examples would better teach me how easy it is to inject SQL against my "prevention".

5
задан Jay Namon 3 March 2011 в 17:51
поделиться