# SQL Injection in JSON

**URL:** <https://clarionhub.com/t/sql-injection-in-json/7382>\
**Category:** questions\
**Tags:** nettalk, json, security\
**Created:** [August 9, 2024, 5:53am UTC](https://clarionhub.com/t/sql-injection-in-json/7382 "2024-08-09T05:53:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Niels\_Larsen](https://clarionhub.com/user_avatar/clarionhub.com/niels_larsen/32/655_2.png) [@Niels\_Larsen](https://clarionhub.com/u/Niels_Larsen)\
**Post date:** [August 9, 2024, 5:53am UTC](https://clarionhub.com/t/sql-injection-in-json/7382/1 "2024-08-09T05:53:46Z")

</div>

Hi  
I have made a REST api in NTWS. It works magnificent.  
But now I am asked if it is possible to do SQL Injection in the values ​​that are transferred.  
I guess I need some good advice here!  
Any comments?

/Niels

---

<div class="post-metadata">

**Author:** ![Owen](https://clarionhub.com/letter_avatar_proxy/v4/letter/o/b2d939/32.png) [@Owen](https://clarionhub.com/u/Owen)\
**Post date:** [August 9, 2024, 5:58am UTC](https://clarionhub.com/t/sql-injection-in-json/7382/2 "2024-08-09T05:58:15Z")

</div>

Are you sanitizing the parameters passed to the Rest API?

If you are not, then there is definitely a risk of SQL injection

---

<div class="post-metadata">

**Author:** ![Bruce](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/ccd318/32.png) [@Bruce](https://clarionhub.com/u/Bruce)\
**Post date:** [August 10, 2024, 12:39am UTC](https://clarionhub.com/t/sql-injection-in-json/7382/3 "2024-08-10T00:39:41Z")

</div>

If you are using NetTalk, and by extension the File Driver (not prop:sql) to write to the file, then no theres no risk of sql injection.

The file drivers make use of parametized queries when writing to the database. This is slightly different to just writing plain SQL but one of the main benefits is that this prevents SQL injection.

One of the dangers of using prop:sql is that this protection is lost. (Which is why NetTalk doesnt use it.)

---

<div class="post-metadata">

**Author:** ![Niels\_Larsen](https://clarionhub.com/user_avatar/clarionhub.com/niels_larsen/32/655_2.png) [@Niels\_Larsen](https://clarionhub.com/u/Niels_Larsen)\
**Post date:** [August 13, 2024, 3:45am UTC](https://clarionhub.com/t/sql-injection-in-json/7382/4 "2024-08-13T03:45:07Z")

</div>

Thanks Bruce for making it clear so even I can understand it.

---

<div class="post-metadata">

**Author:** ![RchdR](https://clarionhub.com/letter_avatar_proxy/v4/letter/r/d78d45/32.png) [@RchdR](https://clarionhub.com/u/RchdR)\
**Post date:** [August 13, 2024, 8:04am UTC](https://clarionhub.com/t/sql-injection-in-json/7382/5 "2024-08-13T08:04:35Z")

</div>

This could have been explained in the docs, but then who would have done a driver trace to see what is being sent to the backend?

---

<div class="post-metadata">

**Author:** ![Bruce](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/ccd318/32.png) [@Bruce](https://clarionhub.com/u/Bruce)\
**Post date:** [August 14, 2024, 2:29am UTC](https://clarionhub.com/t/sql-injection-in-json/7382/6 "2024-08-14T02:29:53Z")

</div>

It would be even better to document that Prop:SQL statements DO NOT enjoy the protection of parameterisation. When using PROP:SQL it is up to the developer to ensure that the command is properly sanitised, and safe to use.

For this reason, if not for any other, it is important to avoid the use of Prop:SQL wherever possible. And if you do use it then all variable values used in WHERE, ORDER BY et al clauses are passed through a sanitiser first to ensure that no malicious code is being entered.