MS SQL

Prevent queries from SQL Injection attack in SQL Server 2005

Please support our MS SQL advertiser: Intel Parallel Studio Home

•

Join Date: Sep 2006

Posts: 116

Reputation: bhavna_816 is an unknown quantity at this point

Solved Threads: 0

bhavna_816 bhavna_816 is offline

Offline

Junior Poster

Prevent queries from SQL Injection attack in SQL Server 2005

May 29th, 2008

I am using SQL Server 2005, I have some select and update statements in my query with WHERE clause

I want to prevent these queries from SQL injection attacks.
What are the steps and precautions to be taken for SQL Injection attacks?
Does anybody have suggestions?

Thanks in advance,

•

Join Date: Sep 2006

Posts: 100

Reputation: M_K_Higa is an unknown quantity at this point

Solved Threads: 2

M_K_Higa

Offline

Junior Poster

Re: Prevent queries from SQL Injection attack in SQL Server 2005

Jun 5th, 2008

Use stored procedures and pass the data you need to update as parameters.

-Mike

•

Join Date: Mar 2008

Posts: 3

Reputation: TCBW is an unknown quantity at this point

Solved Threads: 1

TCBW

Offline

Newbie Poster

Re: Prevent queries from SQL Injection attack in SQL Server 2005

Jun 5th, 2008

The common method is to use regular expressions against the text that will be used in the where clause. The initial poster is correct in that stored procedures and parameters will stop this, but, if you are going to execute a sting built in the stored procedure you are still susceptible to an injection attack.