Re: SQL Injection with ADO parameters

Gaspar, Try something like this...

--ADO algorithm to fire sp with input params

Dim oCmd As Command, param As Parameter
Dim cn As New ADODB.Connection, sqlString As String

sqlString = "YourStoredProc"
Set oCmd = New ADODB.Command
Set cn = CurrentProject.Connection
Set oCmd.ActiveConnection = cn
oCmd.CommandText = sqlString
oCmd.CommandType = adCmdStoredProc
oCmd.CommandTimeout = 15

Set param = New ADODB.Parameter
param.Type = adChar
param.Size = 8 ' 3 bytes
param.Direction = adParamInput
param.Value = YourParam
param.Name = "Param1"
oCmd.Parameters.Append param


oCmd.Execute , , adExecuteNoRecords



"Gaspar" <noreply@xxxxxx> wrote in message
news:upRZrJzMGHA.3728@xxxxxxxxxxxxxxxxxxxxxxx
Is it possible to hack SQL Server with injection via ADO Parameters?

Suppose I have the following query "SELECT * FROM myTable WHERE id =
:param"?
I know that the following is unsafe: "SELECT * FROM myTable WHERE id = " +
value, but what about using parameters like the example above?

Thanks!




.

Relevant Pages

  • Re: Copying Directories
    ... Here is a program for getting rid of junk files. ... * @param pName ... DirFilter(String[] pAvoidDirs) ... * exec command to invoke NT command processor customised for my ...
    (comp.lang.java.programmer)
  • Re: Is Java Applet Best?
    ... * @param pName ... DirFilter(String[] pAvoidDirs) ... * Accept only junk files to be deleted. ... * exec command to invoke NT command processor customised for my ...
    (comp.lang.java.programmer)
  • Re: SOS.dll loses symbol information
    ... Then I hit go and load the main page. ... stack along with the param names and actual source code line numbers. ... Then execute ".reload" to get the debugger to re-resolve symbols using the ... Execute a "k" command to resolve a stack that contains ...
    (microsoft.public.dotnet.framework.clr)
  • Re: bash (sh?) scripting question
    ... command and verify the exit code: ... contains the result of the echo command. ... for param in $* ...
    (comp.unix.shell)
  • Re: the procedure executed successfully but did not return records
    ... Dim oCmd As Command, param As Parameter ... sqlString As String ... sqlString = "YourStoredProc" ... UPDATE MiscCharges SET Description='New Description' ...
    (microsoft.public.access.adp.sqlserver)