SQL Injection

Question

What is SQL Injection and How to Prevent Attacks?

Answer 1

SQL Injection can occur when you build statements by concatenating user input into SQL statements, for instance:

stmt = "INSERT tbl (a, b) VALUES('" + a.text + "','" + b.text + "')"

The this permits the user to enter something with a single quote and all of a sudden there is a different statement. This is a very bad coding pattern which you must never use.

I have an article on my web site where I discuss dynamic SQL, and it includes a section of how to write parametrised statements and there is also a chapter on SQL injection. You find it here: http://www.sommarskog.se/dynamic_sql.html.

Answer 2

Hi @Prancer Io ,

SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives.

To prevent SQL injection, please refer to the following articles which might help:
SQL Injection: Detection and prevention
SQL Injection Tutorial: Learn with Example
Best Regards,
Amelia

---

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.