Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was looking through some coding standards at my work and I came across this:

string query = "SELECT * FROM USERS WHERE USER_ID='" + userIdFromWebPage + "'";

userIdFromWebPage is a variable that contains untrusted data that has not been validated.

Imagine that it contains one of the following:

  • "' or 1=1 -"
  • "' ;DROP TABLE users -"
  • "' ;exec xp_cmdshell(''format c:') -"

The final query could look like this.

string query = "select * FROM USERS WHERE USER_ID='';exec xp_cmdshell('format c:') -";

This results in a format of the c:\ drive on the database server.

Is that actually true?

share|improve this question
That little Bobby Tables is such a scamp, isn't he? – mfinni Jan 24 '12 at 17:52
up vote 3 down vote accepted

The real question is can that code be used for SQL Injection? and the answer is absolutely yes. The days of vandals who would format your drive just to spread mayhem are long gone, nowdays the attacks are mounted by individuals interested in financial gain, they will usually use the SQL injection vector usually to add your host to their botnet, sometimes to steal information you may have, sometimes to take your data hostage and ask for ransom (encrypt it and ask for compensation for decryption). So they will unlikely issue a format c:.

Can xp_cmdshell be used to issue a command like format c:? Not by default, ever since SQL 2005 the engine disables xp_cmdshell by default and an administrator has to explicitly enable it back. But if it is enabled, can it be used? Yes. Will the OS format the c: drive? Unlikely. No OS around today accepts a format of the system volume.

But ultimately the point is that your code should not allow for SQL injection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.