How can SQL Injection be stopped?

Question

How can SQL Injection be stopped?

Answer 1

Just do a simple search on google and you will get lots of articles

Few are listed below

https://msdn.microsoft.com/en-us/library/ff648339.aspx

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

http://www.codeproject.com/Articles/9378/SQL-Injection-Attacks-and-Some-Tips-on-How-to-Prev

http://www.veracode.com/security/sql-injection

---

Please Mark This As Answer if it solved your issue
Please Vote This As Helpful if it helps to solve your issue
Visakh
----------------------------
My Wiki User Page
My MSDN Page
My Personal Blog
My Facebook Page

Answer 2

One simple way is using stored procedures with parameters (I assume you won't provide a WHERE condition as a string  as a parameter :-))

---

Best Regards,Uri Dimant SQL Server MVP, http://sqlblog.com/blogs/uri_dimant/

MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting: Large scale of database and data cleansing
Remote DBA Services: Improves MS SQL Database Performance
SQL Server Integration Services: Business Intelligence

Answer 3

How can SQL Injection be stopped?

Electric shocks in the keyboard everytime a developer inlines parameters into the SQL string.

Preventing SQL injection is all about discipline and education.

Answer 4

Hi Research4,

Regarding Dynamic SQL:

Using sp_executesql stored procedure rather than EXEC. You can use parameters.

You will avoid classic concatenations along with ''

Answer 5

How can SQL Injection be stopped?

Electric shocks in the keyboard everytime a developer inlines parameters into the SQL string.

Preventing SQL injection is all about discipline and education.

A great idea...LOL

---

Cheers,

Shashank

Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

My TechNet Wiki Articles
MVP

Answer 6

you can simply prevent SQL injection by using stored procedures. it takes the injected code as a variable and returns an empty result set.  Please have a look on here: http://www.sqlserverlogexplorer.com/prevent-sql-injection-in-sql-server/

Stored procedure certainly helps but not:

1) If bad developer builds an EXEC string rather than using CommandType.StoredProcedure.
2) Bad developer builds dynamic SQL improperly in the stored procedure.

Answer 7

you can simply prevent SQL injection by using stored procedures. it takes the injected code as a variable and returns an empty result set.  Please have a look on here: http://www.sqlserverlogexplorer.com/prevent-sql-injection-in-sql-server/

This article is full of platitudes and errors. The recommended remedy is also incorrect and can lead new users to a false sense of security. The article ends with some random statement telling users to use undocumented functions to read the t-log. How does that prevent SQL injection?

Please stop referencing this article. 

---

No great genius has ever existed without some touch of madness. - Aristotle

Answer 8

Its basically log reading tool advertisement

---

Cheers,

Shashank

Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

My TechNet Wiki Articles
MVP