Re: how to code to avoid SQL insertion attacks

From: Tor Iver Wilhelmsen (tor.iver.wilhelmsen_at_broadpark.no)
Date: 02/23/05 

Date: 23 Feb 2005 20:18:14 +0100

steve <me@me.com> writes:

> wrong

Not wrong.

> to be able to hinder a hacker , you think like a hacker, whilst this may not
> produce ., ideal code you have to offset it against the risk.
> since he did not specify the risk.

But a hacker does not write the SQL - the programmer does. That's the
point of PreparedStatement, to hinder the hacker in writing SQL.

> it is to GAIN INFORMATION from the database that would not normally be
> available.

And that is not possible since the hacker does not see the SQL.

> the above would not gain any information form the database, since
> you need to know the inner workings of the routine.

It's needlessly cryptic to the developer.

Again: In modern software systems, the code's SQL statements are NOT
VISIBLE to the user/hacker no matter how they are written.

> and that was the whole point, you are not seeing the BIG picture.

We're thankfully not seeing the same picture you are.

> READ THE THREAD.

Where everyone except you are making sense.

Relevant Pages

  • Re: empty values in INSERT INTO statement
    ... The point is that if you don't make it difficult for a hacker, ... he will realize that sql injection is not going to work ... > values for possible SQL injection is pointless. ... Bob Barrows ...
    (microsoft.public.inetserver.asp.db)
  • Re: Ask EU: wireless connection
    ... implications and decided I was willing to take the risk that a hacker ... that a hacker might be able to turn off my anti-virus scans without my ... control AVG from a non-admin account - but do think about the risks ... Digital Grauniad with a cup of tea until the scanner stops ...
    (uk.media.radio.archers)
  • Re: empty values in INSERT INTO statement
    ... case-sensitive without some more arguments, while SQL is not, so ... What's even more, even without parameterizing those values, a SQL injection ... Bottom line, any time you're thinking "punish the hacker," you're treading ...
    (microsoft.public.inetserver.asp.db)
  • Re: Mount points in 2003 Failover Cluster??
    ... but it is your own risk and Microsoft Product Support Services ... SQL Server 2000 SP4 will come out before SQL ... This posting is provided "AS IS" with no warranties, and confers no rights. ...
    (microsoft.public.sqlserver.server)
  • Re: www.domain.com website
    ... host your website then risk getting your SBS server compromised by a hacker. ...
    (microsoft.public.windows.server.sbs)