Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

IBM Appscan has detected that some pages in our system are vulnerable to SQL Injection.

The report shows which URLs are vulnerable, so I checked the pages based on the URLs, but most of the pages reported used CAML query to retrieve/add new/update data from list, so no straight SQL query to Database.

I do some research about SQL Injection in CAML query, and found this Link

The question is, is CAML query vulnerable to SQL Injection? If no, is there any proof documentation or something? If yes, then how do we prevent it?

Thank you.

share|improve this question
    
Not really related, just curious, are you really using <Batch> to add new/update list data? –  eirikb Feb 17 at 6:49
    
Hi eirikb, to delete item from list I'm using <Batch>, but for add new/update item I'm using SPList AddItem() and SPListItem Update() –  kamal Feb 19 at 1:36
    
Ok, I probably just misunderstood, since that is the only way I know how to add new/update using CAML. –  eirikb Feb 19 at 12:01
add comment

1 Answer

up vote 9 down vote accepted

CAML queries are NOT vulnerable to SQL injection.

I don't think you'll find any direct reference or proof. Consider that the conversion from CAML to SQL all happens between the data layer and the SharePoint API. You can't control how SharePoint generates the SQL for a given CAML statement and therefore you don't have to worry about SQL injection. That's handled by SharePoint.

share|improve this answer
    
Nice! Thank you very much. –  kamal Feb 17 at 2:45
    
It would be nice to have an authoritative statement from MS on this. social.technet.microsoft.com/Forums/sharepoint/en-US/… isn't quite it, but at least comes from an MS site... –  Alan M Feb 18 at 22:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.