By jrpurdon
via blog.inetu.net
Published: Dec 18 2009 / 03:21
SQL Injections occur when attackers enter malformed SQL statements into data input fields. The attacker can modify or retrieve data from your database and, in some cases, they can even access data stored in your filesystem outside of SQL Server.
Comments
mrjohnson replied ago:
Ug, no. Just... no. I don't know why people go messing with their web server to solve sql injection. Use prepared statements. All statements should be prepared whether they have parameters or not. While you're at it, wrap the entire DB api and leave out support for anything but prepared statements.
I don't know why it continues to be a debate in the .net world, this is pretty standard in Java. It's easy and makes SQL Injection near impossible.
Voters For This Link (8)
Voters Against This Link (0)