Re: SQL Injection???

["Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>]

> Are SQL injection attacks 
> really a big issue using CGIDEV2?

The "language" used has nothing to do with the issue of SQL Injection.
If you're concatenating values from your website into a string to send
to the sql engine (DB2, Oracle, SQLServer, MySQL, etc.) it's an issue. 

And don't forget, that applies to values from your site regardless of
how they're entered on the page. I've seen people who protect the input
text boxes, but don't worry about the drop-down lists with the argument
that the drop-down lists are controlled from the server. Then I show
them fiddler and the ability to change the post-values on the fly and
that argument goes out the window. 

Don't forget, SQL Injection isn't something that happens by accident.
It's highly unlikely that your average end-user is going to accidently
enter something that causes the issue (single quotes not withstanding).
SQL Injection is usually an honest hack-attempt by someone that know
what they're doing, and has the tools to do it.

-Walden