----------------------------------------------------------- New Message on MumbaiUserGroup
----------------------------------------------------------- From: K_B_Rao Message 2 in Discussion Hi Folks, This is K.B.Rao, --> What is SQL injection? An SQL injection attack "injects" or manipulates SQL code by adding unexpected SQL to a query. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. Username: ' or 1=1 --- Password: [Empty] This would execute the following query against the users table: select count(*) from users where userName='' or 1=1 --' and userPass='' --- SQL Injection : Avoid using dynamically generated SQL with user input. SQL injection occurs when input from a malicious user is used to perform unauthorized actions, such as retrieving too much data or destructively modifying data. Parameterized stored procedures and parameterized SQL statements can help reduce the likelihood of SQL injection. Parameter collections force parameters to be treated as literal values so that the parameters are not treated as executable code. You should also constrain all user input to reduce the likelihood that a malicious user could use SQL injection to perform unauthorized actions - - - SQL Injection : The hacker/attacker always tries to play with your application through additional SQL commands .This SQL Statements destroy your application's data. As a developer you must take care of all vulnerable inputs pass through SQL statements For example lets say your are trying to search customer details by taking the customer name as input passed by the user. If you do not validate the user's input and directly process at your data source can cause a heavy damage to your application. Suppose the attacker passes the customer name as "1;DROP TABLE CustMaster" , and your application process the input as below string strQuery = "SELECT * from CustMaster WHERE CustName="+txtCustName.Text; SqlCommand cmd = new SqlCommand( strQuery, conn); conn.Open(); SqlDataReader myReader = cmd.ExecuteReader(); myReader.Close(); conn.Close(); As a developer you must keep in mind one very important thing that "never trust on user's input", always validate the inputs and then process the data.<o:p></o:p> ----------------------------------------------------------- To stop getting this e-mail, or change how often it arrives, go to your E-mail Settings. http://groups.msn.com/MumbaiUserGroup/_emailsettings.msnw Need help? If you've forgotten your password, please go to Passport Member Services. http://groups.msn.com/_passportredir.msnw?ppmprop=help For other questions or feedback, go to our Contact Us page. http://groups.msn.com/contact If you do not want to receive future e-mail from this MSN group, or if you received this message by mistake, please click the "Remove" link below. On the pre-addressed e-mail message that opens, simply click "Send". Your e-mail address will be deleted from this group's mailing list. mailto:[EMAIL PROTECTED]
