How Do We Protect Agaist SQL Injection Attacks? Please Help.

Discussion in 'C#' started by seogoat, Oct 8, 2008.

0
  1. #1
    How Do We Protect Agaist SQL Injection Attacks? Please Help.
     
    seogoat, Oct 8, 2008 IP
  2. vihutuo

    vihutuo Well-Known Member

    Messages:
    1,511
    Likes Received:
    34
    Best Answers:
    0
    Trophy Points:
    180
    #2
    Use stored procedures for database queries. Validate all user input . Check for valid query string values before using them
     
    vihutuo, Oct 8, 2008 IP
  3. VishalVasani

    VishalVasani Peon

    Messages:
    560
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Hello

    Below link will help you.

    http://www.codeproject.com/KB/database/SqlInjectionAttacks.aspx
    http://www.codeproject.com/KB/web-security/SqlInjection.aspx
    http://www.4guysfromrolla.com/webtech/061902-1.shtml

    According me create a function the remove the character that are responsible for sql injections.
    Apply this function to all the input data and querystrings.
     
    VishalVasani, Oct 13, 2008 IP
  4. qxiu

    qxiu Peon

    Messages:
    82
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #4
    close some stored procedures for database queries
     
    qxiu, Oct 14, 2008 IP
  5. Freewebspace

    Freewebspace Notable Member

    Messages:
    6,213
    Likes Received:
    370
    Best Answers:
    0
    Trophy Points:
    275
    #5
    Just Filter out your input query for special characters and SQL commands.. this is the simplest way to prevent..

    Here is good source about it

    http://www.acunetix.com/websitesecurity/sql-injection.htm
     
    Freewebspace, Oct 14, 2008 IP
  6. ranabra

    ranabra Peon

    Messages:
    125
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #6
    StoredProcedure is a good way.
    I think filtering out your input query for special characters and SQL commands is effective but has some problems and limitations
    If you are using ASP.NET when dealing with the DB make sure you use params (command.Paramaters.Add)
     
    ranabra, Oct 16, 2008 IP