{"id":52022,"date":"2021-09-28T00:00:00","date_gmt":"2021-09-28T07:00:00","guid":{"rendered":"https:\/\/griddb-linux-hte8hndjf8cka8ht.westus-01.azurewebsites.net\/blog\/an-introduction-to-tql-injections\/"},"modified":"2021-09-28T00:00:00","modified_gmt":"2021-09-28T07:00:00","slug":"an-introduction-to-tql-injections","status":"publish","type":"post","link":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/","title":{"rendered":"An Introduction to TQL Injections"},"content":{"rendered":"<h2>Introduction<\/h2>\n<p>One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as <a href=\"https:\/\/en.wikipedia.org\/wiki\/SQL_injection\">SQL injection<\/a>. For the unfamiliar, SQL injections are SQL statements which can be executed by malicious actors in vulnerable websites to extract personal\/valuable info of their choosing.<\/p>\n<p>In this blog, we will be taking a look at <a href=\"https:\/\/griddb.net\/en\/blog\/griddb-query-language\/\">TQL<\/a> injections &#8212; what they are and how to protect against them. Because TQL is rather similar to SQL, perhaps the lessons and techniques learned here can serve as a general guideline for other <a href=\"https:\/\/en.wikipedia.org\/wiki\/Code_injection\">code injection<\/a> attacks.<\/p>\n<h2>SQL\/TQL Injection<\/h2>\n<p>To demonstrate how a TQL injection attack may look, take a look at the following example:<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">tql=\"select * where id='\"+user_input+\"'\"\n    col.query(tql)<\/code><\/pre>\n<\/div>\n<p>This seems innocent enough &#8212; the website\/app takes user input to query the DB to dig up the user&#8217;s username. But let&#8217;s say a malicious actor enters a user input that is equal to &#8220;12&#8221;, the executed query would look like:<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">select * where id='12'<\/code><\/pre>\n<\/div>\n<p>Nothing broken yet. But because the user is allowed to enter anything into the input box, he can also enter something like <code>12' OR id LIKE '%'<\/code>:<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">select * where id='12' OR id LIKE '%'<\/code><\/pre>\n<\/div>\n<p>Because this full query is allowed to run without any sort of defense from the developer, the malicious attacker would then fetch tons of information from the database that they would normally not be able to access.<\/p>\n<h2>Possible Solutions<\/h2>\n<p>There are any number of ways to defend against these sorts of injection attacks &#8212; for this specific blog we will discuss parameterizing, containerizing, sanitizing inputs, and encoding of URL data.<\/p>\n<h3>Parameterize<\/h3>\n<p>To parameterize something is to set a &#8220;limit or boundary that defines the scope of a particular process or activity&#8221;. For this method, we will be utilizing <a href=\"https:\/\/en.wikipedia.org\/wiki\/Java_Database_Connectivity\">JDBC<\/a> and its <a href=\"https:\/\/griddb.net\/en\/blog\/connecting-to-griddb-via-jdbc-with-sqlworkbench-j\/\">GridDB JDBC connector<\/a>. The idea here is to protect precious data by using JDBC&#8217;s <a href=\"https:\/\/docs.oracle.com\/javase\/tutorial\/jdbc\/basics\/prepared.html\">Prepared Statement<\/a>.<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">query = \"select * from data where id = '\"+user_input+\"';\n    rs = stmt.executeQuery(query);<\/code><\/pre>\n<\/div>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">query = \"select * from data where id = ?\"';\n    PreparedStatement stmt = con.prepareStatement()\n    updateSales.setString(1, user_input);\n    rs = stmt.executeQuery();<\/code><\/pre>\n<\/div>\n<p>In this example, if a user tried entering a wildcard as shown above, the executed statement would return an error instead of precious data. This works because the developer sets a given type instead of an arbitrary SQL statement.<\/p>\n<h3>Containerizing<\/h3>\n<p>In this example, we can use GridDB&#8217;s <a href=\"https:\/\/docs.griddb.net\/architecture\/data-model\/#container\">containers<\/a> architecture to properly protect our data.<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">col = gridstore.get_container(\"sensor_12\") <\/code><\/pre>\n<\/div>\n<p>This, for example, would return the proper data.<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">col = gridstore.get_container(\"sensor_12' OR id LIKE '%\")<\/code><\/pre>\n<\/div>\n<p>But if the user tried the above example with a wildcard, the container would simply return an error as that container does not exist. Simple and extremely effective, though admittedly a tad limited.<\/p>\n<h3>Sanitizing Input<\/h3>\n<p>The method most-often seen used to counter-act injection attacks are escaping or sanitizing inputs. This works by escaping characters which have special meanings.<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">sanitized_input=re.sub(\"\"\", \"\\\"\", re.sub( \"'\", \"\\'\",user_input))\n    sanitized_tql=\"select * where id='\"+sanitized_input+\"'\"<\/code><\/pre>\n<\/div>\n<p>In the example here, all user inputs will be sanitized and cleaned to make sure that unwanted inputs or statements.<\/p>\n<h3>URL Encoding<\/h3>\n<p>The last possible solution we will take a peek at is URL Encoding. Typically this sort of protection method is for data forms which go through HTTP POST methods\/requests. The idea is that all inputs will be encoded before sent to the database which will remove all special characters which can be used for basic injection attacks (like the wildcard we saw earlier)<\/p>\n<div class=\"clipboard\">\n<pre><code class=\"language-py\">tql=\"select * where id='\"+user_input+\"'\"\n    sanitized_input = urllib.parse.quote(user_input)\n    sanitized_tql=\"select * where id='\"+sanitized_input+\"'\"<\/code><\/pre>\n<\/div>\n<p>You can see in the example above that before we run the user&#8217;s input to be queried, we encode the data first.<\/p>\n<h2>Conclusion<\/h2>\n<p>Though we discussed quite a few mitigation tactics for TQL\/SQL Injection attacks, there are many more ways out there to be attacked and to prevent said attacks. Always develop your applications with security in mind!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL injection. For the unfamiliar, SQL injections are SQL statements which can be executed by malicious actors in vulnerable websites to extract personal\/valuable info of their choosing. In this blog, we will be [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":52023,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[121],"tags":[],"class_list":["post-52022","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>An Introduction to TQL Injections | GridDB: Open Source Time Series Database for IoT<\/title>\n<meta name=\"description\" content=\"Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"An Introduction to TQL Injections | GridDB: Open Source Time Series Database for IoT\" \/>\n<meta property=\"og:description\" content=\"Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL\" \/>\n<meta property=\"og:url\" content=\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\" \/>\n<meta property=\"og:site_name\" content=\"GridDB: Open Source Time Series Database for IoT\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/griddbcommunity\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-28T07:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/griddb.net\/wp-content\/uploads\/2025\/12\/TQL-INjections.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1160\" \/>\n\t<meta property=\"og:image:height\" content=\"653\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Israel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@GridDBCommunity\" \/>\n<meta name=\"twitter:site\" content=\"@GridDBCommunity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Israel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\"},\"author\":{\"name\":\"Israel\",\"@id\":\"https:\/\/griddb.net\/en\/#\/schema\/person\/c8a430e7156a9e10af73b1fbb46c2740\"},\"headline\":\"An Introduction to TQL Injections\",\"datePublished\":\"2021-09-28T07:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\"},\"wordCount\":571,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/griddb.net\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage\"},\"thumbnailUrl\":\"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\",\"url\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\",\"name\":\"An Introduction to TQL Injections | GridDB: Open Source Time Series Database for IoT\",\"isPartOf\":{\"@id\":\"https:\/\/griddb.net\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage\"},\"thumbnailUrl\":\"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png\",\"datePublished\":\"2021-09-28T07:00:00+00:00\",\"description\":\"Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage\",\"url\":\"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png\",\"contentUrl\":\"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png\",\"width\":1160,\"height\":653},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/griddb.net\/en\/#website\",\"url\":\"https:\/\/griddb.net\/en\/\",\"name\":\"GridDB: Open Source Time Series Database for IoT\",\"description\":\"GridDB is an open source time-series database with the performance of NoSQL and convenience of SQL\",\"publisher\":{\"@id\":\"https:\/\/griddb.net\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/griddb.net\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/griddb.net\/en\/#organization\",\"name\":\"Fixstars\",\"url\":\"https:\/\/griddb.net\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/griddb.net\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/griddb.net\/wp-content\/uploads\/2019\/04\/fixstars_logo_web_tagline.png\",\"contentUrl\":\"https:\/\/griddb.net\/wp-content\/uploads\/2019\/04\/fixstars_logo_web_tagline.png\",\"width\":200,\"height\":83,\"caption\":\"Fixstars\"},\"image\":{\"@id\":\"https:\/\/griddb.net\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/griddbcommunity\/\",\"https:\/\/x.com\/GridDBCommunity\",\"https:\/\/www.linkedin.com\/company\/griddb-by-toshiba\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/griddb.net\/en\/#\/schema\/person\/c8a430e7156a9e10af73b1fbb46c2740\",\"name\":\"Israel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/griddb.net\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4df8cfc155402a2928d11f80b0220037b8bd26c4f1b19c4598d826e0306e6307?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4df8cfc155402a2928d11f80b0220037b8bd26c4f1b19c4598d826e0306e6307?s=96&d=mm&r=g\",\"caption\":\"Israel\"},\"url\":\"https:\/\/griddb.net\/en\/author\/israel\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"An Introduction to TQL Injections | GridDB: Open Source Time Series Database for IoT","description":"Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/","og_locale":"en_US","og_type":"article","og_title":"An Introduction to TQL Injections | GridDB: Open Source Time Series Database for IoT","og_description":"Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL","og_url":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/","og_site_name":"GridDB: Open Source Time Series Database for IoT","article_publisher":"https:\/\/www.facebook.com\/griddbcommunity\/","article_published_time":"2021-09-28T07:00:00+00:00","og_image":[{"width":1160,"height":653,"url":"https:\/\/griddb.net\/wp-content\/uploads\/2025\/12\/TQL-INjections.png","type":"image\/png"}],"author":"Israel","twitter_card":"summary_large_image","twitter_creator":"@GridDBCommunity","twitter_site":"@GridDBCommunity","twitter_misc":{"Written by":"Israel","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#article","isPartOf":{"@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/"},"author":{"name":"Israel","@id":"https:\/\/griddb.net\/en\/#\/schema\/person\/c8a430e7156a9e10af73b1fbb46c2740"},"headline":"An Introduction to TQL Injections","datePublished":"2021-09-28T07:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/"},"wordCount":571,"commentCount":0,"publisher":{"@id":"https:\/\/griddb.net\/en\/#organization"},"image":{"@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png","articleSection":["Blog"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/","url":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/","name":"An Introduction to TQL Injections | GridDB: Open Source Time Series Database for IoT","isPartOf":{"@id":"https:\/\/griddb.net\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage"},"image":{"@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png","datePublished":"2021-09-28T07:00:00+00:00","description":"Introduction One of the oldest and most successful methods of extracting confidential data from applications and websites is the method known as SQL","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/griddb.net\/en\/blog\/an-introduction-to-tql-injections\/#primaryimage","url":"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png","contentUrl":"\/wp-content\/uploads\/2025\/12\/TQL-INjections.png","width":1160,"height":653},{"@type":"WebSite","@id":"https:\/\/griddb.net\/en\/#website","url":"https:\/\/griddb.net\/en\/","name":"GridDB: Open Source Time Series Database for IoT","description":"GridDB is an open source time-series database with the performance of NoSQL and convenience of SQL","publisher":{"@id":"https:\/\/griddb.net\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/griddb.net\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/griddb.net\/en\/#organization","name":"Fixstars","url":"https:\/\/griddb.net\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/griddb.net\/en\/#\/schema\/logo\/image\/","url":"https:\/\/griddb.net\/wp-content\/uploads\/2019\/04\/fixstars_logo_web_tagline.png","contentUrl":"https:\/\/griddb.net\/wp-content\/uploads\/2019\/04\/fixstars_logo_web_tagline.png","width":200,"height":83,"caption":"Fixstars"},"image":{"@id":"https:\/\/griddb.net\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/griddbcommunity\/","https:\/\/x.com\/GridDBCommunity","https:\/\/www.linkedin.com\/company\/griddb-by-toshiba"]},{"@type":"Person","@id":"https:\/\/griddb.net\/en\/#\/schema\/person\/c8a430e7156a9e10af73b1fbb46c2740","name":"Israel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/griddb.net\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4df8cfc155402a2928d11f80b0220037b8bd26c4f1b19c4598d826e0306e6307?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4df8cfc155402a2928d11f80b0220037b8bd26c4f1b19c4598d826e0306e6307?s=96&d=mm&r=g","caption":"Israel"},"url":"https:\/\/griddb.net\/en\/author\/israel\/"}]}},"_links":{"self":[{"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/posts\/52022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/comments?post=52022"}],"version-history":[{"count":0,"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/posts\/52022\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/media\/52023"}],"wp:attachment":[{"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/media?parent=52022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/categories?post=52022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/griddb.net\/en\/wp-json\/wp\/v2\/tags?post=52022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}