Secure your SQL queries!!!

I thought I'd better make sure that everyone is aware of a particular class of security vulnerabilities called malicious SQL code injections. While there are many other security vulnerabilities, these are particularly dangerous - left unchecked, a malicious user could access or otherwise manipulate any data in the SQL Server, as well as execute DOS commands, etc.

These vulnerabilities are nothing new, but security is usually the least of most developers' worries, and some developers may not even have considered this angle.

If you are not already familiar with this topic, it is imperative that you read up pronto - you could be unwittingly putting all of your live DB data at risk, and possibly the server itself too!

Please note that although most exploits using this technique target MS SQL Server, some can be applied to Access (and other DBs) too, so you're not necessarily invincible just because you've got a small site running off Access....!

Here's a few sites to start you off (!):
http://www.google.com/search?q=SQL+injection

[Guest]

[36.301]

Yahoo crawler, Googlebot, Gigabot