是否可以使用DBD :: Oracle在单个查询中执行多个语句?

问题描述:

我想知道是否可以在单个内执行多个SQL语句。 execute() do() 使用 DBD :: Oracle 通过Perl DBI 。示例:

I'd like to know if it's possible to execute more than one SQL statement within a single execute() or do() call using DBD::Oracle via Perl DBI. Example:

# Multiple SQL statements in a single query, separated by a ";"
$sql = 'UPDATE foo SET bar = 123; DELETE FROM foo WHERE baz = 456';

$sth = $dbh->prepare($sql);
$sth->execute;

# ...or...

$dbh->do($sql);

我问这个不是因为我想做这样的事情,而是因为我想衡量通过成功的SQL注入攻击可能造成的损害。是的,我知道,无论对该问题的答案如何,都必须从根本上仅使用绑定值和可信输入等来消除SQL注入的可能性。但是问题仍然存在:是否可以使 DBD :: Oracle 执行多个语句?

I ask this not because I want to actually do such a thing, but rather because I want to gauge the damage possible through a successful SQL injection attack. And yes, I know that, regardless of the answer to this question, the possibility of SQL injection must still be eliminated at its root using bind values and trusted input only, etc. But the question still stands: is it possible to make DBD::Oracle execute multiple statements?

作为一个相关示例, DBD :: mysql 具有 mysql_multi_statements 连接选项明确启用此功能。我无法撼动这种感觉,即可以通过 DBD :: Oracle 以某种方式访问​​一些类似的,也许是未记录的且晦涩的Oracle OCI选项,它将启用相同的功能。

As a related example, DBD::mysql has a mysql_multi_statements connection option that explicitly enables this "feature." I can't shake the feeling that there's some similar, perhaps undocumented and obscure Oracle OCI option that's accessible somehow via DBD::Oracle that will enable the same thing.

如果有问题,这是:


  • perl 5.8.8

  • DBD :: Oracle 1.22

  • Oracle 11g(11.01.0700)

  • perl 5.8.8
  • DBD::Oracle 1.22
  • Oracle 11g (11.01.0700)

如果成功进行了SQL注入攻击,攻击者只是简单地重复它并以这种方式运行多个语句?

If there is a successful SQL injection attack, couldn't the attacker simply repeat it and run multiple statements that way as well?

Oracle支持匿名的PL / SQL块,该块可以包含多个语句。

Oracle supports anonymous PL/SQL blocks which can contain multiple statements.

开始执行立即的'drop table客户';执行立即的'drop table sales';结束

"begin execute immediate 'drop table customers'; execute immediate 'drop table sales'; end"

Oracle在此处提供了有关避免SQL注入攻击的免费教程:
http:/ /st-curriculum.oracle.com/tutorial/SQLInjection/index.htm

Oracle provides a free tutorial on avoiding SQL injection attacks here: http://st-curriculum.oracle.com/tutorial/SQLInjection/index.htm