Re: SQL Injection Prevention

From: Aaron [SQL Server MVP] (ten.xoc_at_dnartreb.noraa)
Date: 09/29/04 

Date: Wed, 29 Sep 2004 09:08:41 -0400

> 1) Does this mean the other stored procedures using parametized queries
are all safe?

Tough to give a blanket answer on this one, because we can't see them.

> 2) What is the most effective way to stop sql injection vulnerabilities
from the remaining stored procedures that have dynamic sql in it?

If you can't rewrite the stored procedures to not use dynamic SQL, then make
sure you validate any input that comes from the user *or* the application
before blindly executing it. 

-- 
http://www.aspfaq.com/
(Reverse address to reply.)

Relevant Pages

  • Re: SQL Injection Prevention
    ... > under the impression that all stored procedures contain dynamic SQL. ... more than 1.5 MLoC of Fortran code + more than 1.2 MLoC of C++ ...
    (microsoft.public.sqlserver.server)
  • Re: SQL Injection Prevention
    ... > under the impression that all stored procedures contain dynamic SQL. ... more than 1.5 MLoC of Fortran code + more than 1.2 MLoC of C++ ...
    (microsoft.public.dotnet.security)
  • Re: Dynamic SQL
    ... Dynamic SQL versus stored procedures is really a minimal discussion. ... Obviously if you CAN use stored procedures, you are going to have a MUCH ... With only minimal modification you could make your middle tier use stored ... > While I am not trying to start another discussion about> business rules and where they ...
    (microsoft.public.sqlserver.programming)
  • Re: Confused about proc vs. dynamic SQL vs LINQ
    ... stored procedures are going to be faster than ... performance from dynamic sql (sql that you generate on the client and ... as well as if the queries are the same and a number ... another execution plan would be faster because statistics changed. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Exec statements in stored procedures
    ... > dynamic sql executes in the security context of the current user. ... Dynamic SQL accesses objects directly so permissions on those objects are ... > No. Stored procedures execute in the context of the owner, ...
    (microsoft.public.sqlserver.programming)