Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Antitoxin for "SQL Injection" (?)
From: James Tucker <jftucker () gmail com>
Date: Tue, 3 Jan 2006 02:45:35 +0000

Creative programming combined with the use of stored procedures can
reduce the need (even in some cases, with careful interface design
erradicate completely) the need to use any procedures which could ever
be built for injection.

Of course if you're looking for a sure fire solution every time, use a
database wrapper and translate statements more aggressively to your
application specification. Particularly in the web world you can
generally present information views which will be sufficiently
translatable by careful use of tuple mapping and proper escaping
practices.

Devdas eclaimation was however correct as there are non-security
related reasons to program your applications properly anyway, and
stored procudures are also generally a default choice for most web
applications, particularly public sites.

On 02/01/06, Sen, Adem <asen-public () sage de> wrote:
Hi Devdas,

Do STORED PROCEDURES really protect against any kind of SQL Injection? I
have read many articles about, some say they are and some say they are
NOT!

Isn't there any way to do code injection into a SP or are they
fully-secure against Injections?

I think it is clear, that SP's make your web-app less dynamic?

Thanks!
Adem Sen


Devdas wrote:
Ugh! Why do you not use stored procedures and bind parameters, which
is
the right way to do it?

Devdas Bhagat
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]