Mitigating SQL injection when forced to use substitution variables

Question

The 3rd party software that I use has exactly one way of allowing users to specify runtime parameters: Substitution variables.
The scripts are executed using SQL*Plus. I'm looking for ways to secure this.
Please don't say "Don't use substitution variables" - read above, it's the only way this software works.
My first thought was something like this:
var myvar varchar2(30)
exec :myvar := '&user_input';That's no good. What if the user specifies "X'; execute immediate 'drop table sometable" Then we get
exec :myvar := 'X'; execute immediate 'drop table sometable';Again, no good.
I thought perhaps something like the following would work:
exec :myvar := dbms_assert.noop('&user_input');but then again, a malicious user could specify "'); execute immediate 'drop table sometable'; dbms_assert.noop('"
I'm open to suggestions.
What can I do to sanitize substitution variables?
Thank you!
Edited by: krissco on Jan 30, 2013 3:02 PM

Answer 1

You could use:
var myvar varchar2(30)
exec :myvar := DBMS_ASSERT.ENQUOTE_LITERAL('&user_input');For example:
SQL> exec :myvar := '&user_input';
Enter value for user_input: X';execute immediate 'begin dbms_output.put_line(''XXXX'');end;
XXXX
PL/SQL procedure successfully completed.
SQL> exec :myvar := DBMS_ASSERT.ENQUOTE_LITERAL('&user_input');
Enter value for user_input: X';execute immediate 'begin dbms_output.put_line(''XXXX'');end;
BEGIN :myvar := DBMS_ASSERT.ENQUOTE_LITERAL('X';execute immediate 'begin dbms_output.put_line(''XXXX'');end;'); END;
ERROR at line 1:
ORA-06550: line 1, column 48:
PLS-00103: Encountered the symbol ";" when expecting one of the following:
) , * & = - + < / > at in is mod remainder not rem =>
<an exponent (**)> <> or != or ~= >= <= <> and or like like2
like4 likec as between from using || multiset member
submultiset
The symbol ")" was substituted for ";" to continue.
ORA-06550: line 1, column 110:
PLS-00103: Encountered the symbol ")" when expecting one of the following:
* & = - + ; < / > at in is mod remainder not rem return
returning <an exponent (**)> <> or != or ~= >= <= <> and or
like like2 like4 likec between into
SQL>SY.
Edited by: Solomon Yakobson on Jan 30, 2013 8:28 PM