Hi, could someone give some advices in how to effectively avoid sql
injection?

Just a few suggestions that I can think of on an immediate note:

1) Have all of you activity with your database in the form of stored
procedures (aka. No in-line SQL statements).  If you mandate all 
interface
with your database as stored procedure, then you can go a long way 
toward
protecting yourself & your system. 
2) Parse your commands to the database through a function that replaces
reserved words & characters (SELECT, INSERT, UPDATE, CREATE, DROP, ";", 
as
well as terminators (single quotes)) with other words or characters that
invalidate the "injected" sql.
3) general database administration tasks (like simply degrading rights 
to
known accounts [sql server: sa|<blank password>or sa, oracle: 
scott|tiger]
and managing rights on system tables & objects) is a simple, but often
missed security item.

The .NET ADO.NET training video on the MSDN site shows a very simple SQL
injection attack and how it might be carried out. 

David

-----Original Message-----
From: DT-Rene Vazquez [mailto:renevazquez@c...]
Sent: Monday, March 10, 2003 11:32 AM
To: ADO.NET
Subject: [ado_dotnet] avoid sql injection

Hi, could someone give some advices in how to effectively avoid sql
injection?

=3D=3D=3D
Fast Track ADO.NET with C# is a concise introduction to the concepts,
techniques, and libraries that you will need in order to start using 
ADO.NET
in your applications. The book covers DataSets and Typed DataSets, 
accessing
data using DataReaders and DataAdaptors, the close relationship between
ADO.NET and XML, how and where to use ADO.NET in your enterprise
applications, and how to use Web Services and ADO.NET to easily pass 
data
between applications.
http://www.wrox.com/books/1861007604.htm

This would be helpful for u

http://www.sqlsecurity.com/DesktopDefault.aspx?tabindex=2&tabid=3


cheers
Kings

-----Original Message-----
From: DT-Rene Vazquez [mailto:renevazquez@c...]
Sent: Monday, March 10, 2003 10:02 PM
To: ADO.NET
Subject: [ado_dotnet] avoid sql injection


Hi, could someone give some advices in how to effectively avoid sql
injection?

===
Fast Track ADO.NET with C# is a concise introduction to the concepts,
techniques, and libraries that you will need in order to start using ADO.NET
in your applications. The book covers DataSets and Typed DataSets, accessing
data using DataReaders and DataAdaptors, the close relationship between
ADO.NET and XML, how and where to use ADO.NET in your enterprise
applications, and how to use Web Services and ADO.NET to easily pass data
between applications.
http://www.wrox.com/books/1861007604.htm