Search code examples
sqlstatasql-injection

How do match strings inside SQL injections in Stata?

I am trying to inject SQL statements inside Stata in the following way:

obdc load, exec('"select * from table_name as u, l2010 as lv where u.IntUft='I'"') dsn("some_db") clear

But this gives me a r(198) error saying table() or exec() is required.

When i tried the same code with an integer, it did work. That means,

obdc load, exec('"select * from table_name as u, l2010 as lv where u.Ar=2000"') dsn("some_db") clear

works.

Any idea on how to compare Strings inside SQL statements like that in Stata?

Solution

  • I have not used obdc myself, so I am not sure it is the full solution, but I spot two Stata syntax bugs.

    In Stata, the leading single quote in a compounded string must be a back quote `. So you need exec(`"select.

    Similarly, when referencing a local macro you also need to start with the back quote. So you need u.IntUft=`I'"'.

    See full example here:

    obdc load, exec(`"select * from table_name as u, l2010 as lv where u.IntUft=`I'"') dsn("some_db") clear

    Not sure if you need to compound the string, so it might be enough to fix the local reference.

    How your second example works, despite technically also having a syntax bug, must be due to how the command obdc handles/cleans the string input.