Links that lead to off-site pages about databases.

Connection strings

Database makers

SQL injection

SQL injection is a security vulnerability that tries to abuse user input.

EGs:

"select * from users where name='" + UserName "';" //if 's not escaped as '', may become:
select * from users where name='' or ''='';

"select * from users where name='" + UserName "';"  //if --s not checked, may become:
select * from users where name='' or (1=1)--'; 

"select * from users where name='" + UserName "';"  //if ;s not checked, may become:
select * from users where name='';delete users 

"select * from users where id=" + UserID  //if datatype or length not checked, may become:
select * from users where id=4 or id is not null;

//Limit the permissions given to the SQL login.
//Instead of "SELECT * ...", use something like "SELECT price ..."
//Store sensitive info like passwords as hashes.

Miscellany

2008-06-09 15:32:10Z