Re: SQL Injection???

[Pete Helgren <Pete@xxxxxxxxxx>]

Shane,

SQL injection can compromise *any* application, web or not, regardless 
of framework.  If the SQL parameter is passed as a string an appended to 
a "where" clause for example and isn't checked for length or content 
then the resulting executed query can be considered SQL injectable.  You 
can do this in a green screen app, fat client or web application. 

The issue is how are the SQL parameters passed to the dynamic statement 
and can the output be used maliciously.  That will determine your 
exposure.  Parameterized statements, encoding and other techniques can 
be used to limit your exposure.

Pete


Shane_Cessna@xxxxxxx wrote:
> All:
>
> Has anyone using CGIDEV2 implemented a solution to prevent SQL Injection 
> attacks in your applications?  If so, what did you use and how did you do 
> it?
>
> This is one of my security goals for this year in case you're curious.
>
> Shane Cessna
> Senior Programmer
> North American Lighting, Inc.
> 217.465.6600 x7776 
>