Re: Full Text Query can cause SQL Injection attack?

Sure--any improperly formed query (i.e., one that uses dynamic SQL the wrong way) can open the door to a SQL injection attack. If you can post your code we can critique it and let you know if it has any issues.


--

Adam Machanic
SQL Server MVP - http://sqlblog.com

Author, "Expert SQL Server 2005 Development"
http://www.apress.com/book/bookDisplay.html?bID=10220



"anoop" <anoop@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:BFD7F829-7DCA-4B0D-BDBC-8F472C5F0322@xxxxxxxxxxxxxxxx
Hello,
I wanted to know if Full text query can cause SQL Injection attack
in an application which is using SQL server at the back end.

Thank you

Anoop

.

Relevant Pages

  • Re: Sql injection and data adapters
    ... insert/update/delete statements, so your answer is NO, you will not be ... subject to a SQL injection attack from them. ... SQL statement with its parameter markers are parsed, ... if I do this, am I open to a sql injection ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: Sql injection and data adapters
    ... insert/update/delete statements, so your answer is NO, you will not be ... subject to a SQL injection attack from them. ... SQL statement with its parameter markers are parsed, ... if I do this, am I open to a sql injection ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: sqlite help needed with my proc....
    ... near "'s automotive)": syntax error ... Along with all the other advice, be aware that this sort of thing can ... lead to what's called an "SQL injection attack". ... use sqlite's ability to expand tcl variable names you don't have to worry about injections so much since the whole of your data gets stored in the column rather than being treated as an sql string. ...
    (comp.lang.tcl)
  • Re: SQL statement - chop phrase
    ... with (just good programming), anything that even looks like it might open up ... a SQL injection attack should not be done, unless you KNOW what you're doing ... SQL, the hacker can do the following: ... Links for SQL Server Books Online: ...
    (microsoft.public.sqlserver.server)
  • Re: how to code to avoid SQL insertion attacks
    ... then it's not an SQL injection attack. ...
    (comp.lang.java.programmer)