Re: SQL Injection Prevention

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Shabam (blislecp_at_hotmail.com)
Date: 09/29/04 

Date: Wed, 29 Sep 2004 06:38:36 -0700

> > 2) What is the most effective way to stop sql injection vulnerabilities
> > from the remaining stored procedures that have dynamic sql in it?
>
> Execute dynamic SQL inside stored procedures only with sp_executesql
> containing parameters for all user input; do not use EXECUTE. The
remainder
> of the SQL statement string needs to be constructed from a trusted source.

Can you explain this one in a more newbie fashion, or point me to an article
that may help explain this in more detail? Thanks! :)

Relevant Pages

  • Re: SQL Injection Prevention
    ... > under the impression that all stored procedures contain dynamic SQL. ... more than 1.5 MLoC of Fortran code + more than 1.2 MLoC of C++ ...
    (microsoft.public.sqlserver.server)
  • Re: SQL Injection Prevention
    ... > under the impression that all stored procedures contain dynamic SQL. ... more than 1.5 MLoC of Fortran code + more than 1.2 MLoC of C++ ...
    (microsoft.public.dotnet.security)
  • Re: Dynamic SQL
    ... Dynamic SQL versus stored procedures is really a minimal discussion. ... Obviously if you CAN use stored procedures, you are going to have a MUCH ... With only minimal modification you could make your middle tier use stored ... > While I am not trying to start another discussion about> business rules and where they ...
    (microsoft.public.sqlserver.programming)
  • Re: Confused about proc vs. dynamic SQL vs LINQ
    ... stored procedures are going to be faster than ... performance from dynamic sql (sql that you generate on the client and ... as well as if the queries are the same and a number ... another execution plan would be faster because statistics changed. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Exec statements in stored procedures
    ... > dynamic sql executes in the security context of the current user. ... Dynamic SQL accesses objects directly so permissions on those objects are ... > No. Stored procedures execute in the context of the owner, ...
    (microsoft.public.sqlserver.programming)