Prevent queries from SQL Injection attack in SQL Server 2005

•

What is DaniWeb IT Discussion Community?

You're currently browsing the MS SQL section within the Web Development category of DaniWeb, a massive community of 391,686 software developers, web developers, Internet marketers, and tech gurus who are all enthusiastic about making contacts, networking, and learning from each other. In fact, there are 3,204 IT professionals currently interacting right now! Registration is free, only takes a minute and lets you enjoy all of the interactive features of the site.

Join our community!

Please support our MS SQL advertiser:

Thread Tools Display Modes

Views: 744 | Replies: 2

•

Join Date: Sep 2006

Posts: 104

Reputation: bhavna_816 is an unknown quantity at this point

Rep Power: 2

Solved Threads: 0

bhavna_816 bhavna_816 is offline

Offline

Junior Poster

Prevent queries from SQL Injection attack in SQL Server 2005

May 29th, 2008

I am using SQL Server 2005, I have some select and update statements in my query with WHERE clause

I want to prevent these queries from SQL injection attacks.
What are the steps and precautions to be taken for SQL Injection attacks?
Does anybody have suggestions?

Thanks in advance,

•

Join Date: Sep 2006

Location: San Diego, CA USA

Posts: 99

Reputation: M_K_Higa is an unknown quantity at this point

Rep Power: 2

Solved Threads: 2

M_K_Higa

Offline

Junior Poster in Training

Re: Prevent queries from SQL Injection attack in SQL Server 2005

Jun 5th, 2008

Use stored procedures and pass the data you need to update as parameters.

-Mike

•

Join Date: Mar 2008

Posts: 3

Reputation: TCBW is an unknown quantity at this point

Rep Power: 0

Solved Threads: 1

TCBW

Offline

Newbie Poster

Re: Prevent queries from SQL Injection attack in SQL Server 2005

Jun 5th, 2008

The common method is to use regular expressions against the text that will be used in the where clause. The initial poster is correct in that stored procedures and parameters will stop this, but, if you are going to execute a sting built in the stored procedure you are still susceptible to an injection attack.