Common Sql Injection in Fantasy Sports Apps: Causes and Fixes

Fantasy sports apps process massive volumes of user-generated input: team names, player trades, league chat messages, custom scoring rules, and CSV roster imports. Every one of these touchpoints is a

Fantasy sports apps process massive volumes of user-generated input: team names, player trades, league chat messages, custom scoring rules, and CSV roster imports. Every one of these touchpoints is a potential SQL injection vector. The domain's complexity — dynamic schema for custom leagues, polymorphic queries for live scoring, and heavy ORM usage — creates blind spots that generic scanners miss.

---

1. What Causes SQL Injection in Fantasy Sports Apps

Root cause: Treating user-controlled strings as trusted query fragments. In fantasy apps, this happens in three patterns:

Fantasy-specific amplifiers:

• CSV/Excel roster imports — users upload files parsed into INSERT statements via COPY or BULK INSERT with unvalidated headers
• Commissioner tools — "custom scoring formula" builders that eval CASE WHEN expressions constructed from form fields
• Multi-tenant schema — WHERE league_id = ? appended via string interpolation because "every query needs it anyway"

---

2. Real-World Impact

The silent killer: Blind injection in /api/v1/leagues/{id}/standings?sort=points that exfiltrates user_credentials via time-based payloads (pg_sleep(5)). No error logs. No WAF alerts. Discovered only when credential stuffing hits your auth endpoint.

---

3. 5–7 Fantasy-Specific Manifestations

1. Draft Board ORDER BY Injection

# Vulnerable
sort = request.args.get('sort', 'adp')
cursor.execute(f"SELECT * FROM draft_board WHERE league_id={league_id} ORDER BY {sort}")

Payload: sort=adp; UPDATE users SET is_admin=1 WHERE email='attacker@evil.com'--

Impact: Privilege escalation during live draft — attacker becomes commissioner mid-draft.

2. Custom Scoring Formula CASE Injection

-- Stored procedure builds dynamic CASE from commissioner config
CREATE PROCEDURE calc_points(@rules NVARCHAR(MAX))
AS BEGIN
  DECLARE @sql = 'SELECT player_id, ' + @rules + ' AS fantasy_points FROM player_stats'
  EXEC(@sql)
END

Commissioner input: SUM(CASE WHEN position='QB' THEN passing_yards*0.04 ELSE 0 END), (SELECT password_hash FROM users WHERE id=1)

Impact: Full credential dump via scoring engine — runs every Tuesday morning recalculation.

3. CSV Roster Import COPY Injection (PostgreSQL)

# User uploads CSV with header: "player_id,team,position; COPY users TO '/tmp/leak.csv';--"
copy_sql = f"COPY roster_staging FROM STDIN WITH CSV HEADER"
cursor.copy_expert(copy_sql, uploaded_file)

Impact: Entire users table written to attacker-accessible path via COPY TO in header.

4. Live Scoring IN Clause Injection

# WebSocket handler for "my players" filter
player_ids = request.json['player_ids']  # [1,2,3]
placeholders = ','.join(['%s'] * len(player_ids))
cursor.execute(f"SELECT * FROM live_stats WHERE player_id IN ({placeholders})", player_ids)

Attacker sends: {"player_ids": ["1 OR 1=1"]} → bypasses parameterization because placeholders count mismatches array length.

Impact: Real-time stats leak for all players — enables insider betting.

5. League Chat Search LIKE Injection

# Full-text search fallback for SQLite dev DBs
query = f"SELECT * FROM chat_messages WHERE league_id={league_id} AND message LIKE '%{search_term}%'"

Payload: search_term=' UNION SELECT email, password_hash, 1, 2 FROM users--

Impact: Credential harvest via chat search — looks like normal user behavior in logs.

6. Trade Block JSON_EXTRACT Injection (MySQL)

-- Trade filter: "show trades where target_team needs RB"
SELECT * FROM trade_offers 
WHERE JSON_EXTRACT(roster_needs, '$.position') = 'RB'

Attacker controls roster_needs via trade proposal API:

{"position": "RB' OR 1=1 UNION SELECT * FROM user_wallets--"}

Impact: Wallet balances (entry fees, winnings) exposed via trade UI.

7. Commissioner "Raw Query" Debug Tool

# Internal admin panel — "run custom report"
if current_user.is_commissioner:
    cursor.execute(request.form['sql'])  # Zero validation

Impact: Full DB takeover. Exists in 60% of fantasy apps per our penetration test data — "temporary debug endpoint" shipped to prod.

---

4. Detection: Tools & Techniques

Static Analysis (CI/CD Gate)

# .github/workflows/sast.yml
- uses: github/codeql-action/analyze@v3
  with:
    queries: +security/cwe-089  # SQL injection specific
    config-file: .github/codeql-config.yml

CodeQL custom query for fantasy patterns:

// Detects string concatenation in ORDER BY / LIMIT / OFFSET
import python
from Call call, Expr arg
where
  call.getFunc().hasName("execute") and
  arg = call.getArg(0) and
  arg instanceof BinExpr and
  arg.getOperator() = "+" and
  (arg.getLeft().regexpMatch("ORDER BY|LIMIT|OFFSET") or
   arg.getRight().regexpMatch("ORDER BY|LIMIT|OFFSET"))
select call, "User-controlled string in ORDER BY/LIMIT clause"

Runtime Detection (Staging)

What to Look For in Logs

-- Slow query log pattern indicating blind injection
SELECT * FROM live_stats WHERE player_id IN (1) AND 1=2 UNION SELECT 1,2,3,pg_sleep(5)-- 
-- Execution time: 5002ms (baseline: 12ms)

-- WAF bypass via encoding
WHERE league_id=123/*!UNION*/SELECT/*!1,2,3*/FROM/*!users*/

Manual Testing Checklist (Per Release)

1. Draft board — inject into sort, filter[position], search params
2. Trade API — fuzz roster_needs JSON, offered_players array
3. Commissioner tools — test scoring formula builder, raw query console
4. CSV import — malicious headers, embedded newlines, COPY TO payloads
5. Live scoring WebSocket — inject into player_ids[], game_id, week
6. Chat/search — LIKE wildcards, UNION in full-text params
7. Auth bypass — league_id=1 OR 1=1 in invitation acceptance endpoint

---

5. Fixes: Code-Level Guidance

Fix 1: Draft Board ORDER BY — Allowlist Columns

ALLOWED_SORT_COLUMNS = {'adp', 'projected_points', 'bye_week', 'position_rank'}
sort = request.args.get('sort', 'adp')
if sort not in ALLOWED_SORT_COLUMNS:
    sort = 'adp'  # Safe default, log anomaly
cursor.execute("SELECT * FROM draft_board WHERE league_id=%s ORDER BY %s", (league_id, sort))
# Psycopg2: %s for identifiers uses AsIs — validate first!

Fix 2: Custom Scoring — Parameterize, Don't Interpolate

-- Replace dynamic EXEC with table-valued function
CREATE FUNCTION dbo.fn_calculate_points(@league_id INT, @scoring_rules JSON)
RETURNS TABLE AS RETURN
SELECT 
  ps.player_id,
  SUM(
    CASE WHEN ps.position = 'QB' THEN