SQL Injection solution:( ?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

dotnettester - 25 Jan 2006 19:12 GMT

Hi,

RE: SQL2K, ASP
--------------------
I am trying to secure a data entry page and want to avoid any sql injections.

Is there a way I can use Command.Parameters with a query (instead of a
storedproc).

Any solution?

Thnx

Reply to this Message

Bob Barrows [MVP] - 25 Jan 2006 20:06 GMT

> Hi,
>
[quoted text clipped - 9 lines]
>
> Thnx

Yes. Use an explicit Command object to pass parameter values to a string
containing parameter markers:
http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36
562fee7804e

This does not relieve you of the responsibility to validate your user inputs
in server-side code, if only to prevent errors related to
incorrectly-entered data.

Bob Barrows

Signature

Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

Reply to this Message

paul@bullschmidt.com - 29 Jan 2006 17:35 GMT

And for another related link:

SQL Injection Walkthrough
http://www.securiteam.com/securityreviews/5DP0N1P76E.html

Best regards,
-Paul
www.Bullschmidt.com - Freelance Web and Database Developer
www.Bullschmidt.com/DevTip.asp - Classic ASP Design Tips

Reply to this Message

Webmaster Forum / ASP / Database Access / January 2006

SQL Injection solution:( ?