Preventing sql injection
210 views 
Can anyone please explain how sql injection can be preventing.
I know filtering the contents at the server side is one of the solution. Filtering characters such as (<,>,', OR,1,= )
There is a possibility few of the webapps may treat these characters as legitimate. For example user name may have O' rilly.
In this case you cant filter the (') character as its a part of the user name.
Prevent SQL Injection Attacks
* Encrypt sensitive data.
* Access the database using an account with the least privileges necessary.
* Install the database using an account with the least privileges necessary.
* Ensure that data is valid.
* Do a code review to check for the possibility of second-order attacks.
* Use parameterised queries.
* Use stored procedures.
* Re-validate data in stored procedures.
* Ensure that error messages give nothing away about the internal architecture of the application or the database.
source:
http://www.codeproject.com/cs/database/SqlInjectionAttacks.asp
©2005 Colin Angus Mackay. All Rights Reserved.
Post new comment