Loading...
Loading...
Dynamic column sorting vulnerable to SQL injection through ORDER BY clause.
1def get_products(sort_by='name'):2 query = f"SELECT * FROM products ORDER BY {sort_by}"3 cursor.execute(query)4 return cursor.fetchall()
ORDER BY clauses cannot use parameterized queries for column names. Whitelisting allowed column names is the only safe approach.
Attacker extracts data by observing result ordering
sort_by=(CASE WHEN (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a' THEN name ELSE price END)If password starts with 'a': sorted by name
If not: sorted by price
✓ Attacker iterates through characters
✓ Extracts full password from ordering behavior