Search code examples
sqlvbams-accesssql-injectionms-access-2010

Microsoft Access SQL Injection

I need to fix some security issues in a non-IT app that we were assigned to maintain. It's in Microsoft Access front-end (SQL Server back-end).

Does anyone know if SQL Injection can be done via the RecordSource or RowSource property of Microsoft Access controls? For example, if I set a listbox's recordsource to

Me.SomeListBox.Recordsource = 'SELECT * FROM SomeTable WHERE SomeField = ''' & Me.txtSomeTextBox & '''.

I'm not sure if Microsoft has built in prevention or not for those properties so I'm wondering if I should be running that Me.txtSomeTextBox through a cleaning function.

This is of course a quick fix... the application is going to be redesigned and migrated out of Access (yay!) later this year.

Thanks in advance guys!

Solution

  • If you're doing string concatenation, you're vulnerable.