Despite Help From Microsoft, SQL Injections Remain A Threat

While the spate of SQL injection attacks appears to have died down from its peak earlier this year, it is still a considerable problem that should be on the radar of all database developers and DBAs.

Any SQL-based database server is vulnerable to a SQL injection, but the ones that have wreaked havoc this year have been directed at Microsoft's SQL Server via malicious code in a SQL query string, directed to the database via a Web app.

As reported last week, the number of unpatched Web sites that are exposing malicious code still is alarmingly high -- some seven of 10 Web apps are unsafe, according to Cenzic's Intelligent Analysis Lab report.