WebApp Sec: RE: tips to secure a web application

["Andy Gordon" <adg () microsoft com>]

> From: .Saphyr [mailto:saphyr () infomaniak ch] 
> Sent: 20 February 2004 02:36
> To: webappsec () securityfocus com
> Subject: Re: tips to secure a web application
> You do not have fewer risks by using jdbc support for 
> database communication. SQL injection flaws are related to an 
> upper layer: 
> the sql language, as jdbc only gives you a wrapper to access 
> many database providers (sql 2000, oracle, odbc, ...). 
>
> You can however mitigate a lot the sql/command injection 
> flaws by using the prepared statements classes (precompiled 
> sql requests on which only parameters are added at runtime) 
> with jdbc. 
>
> For more information , just google 'java prepared statements'. 
Are there any libraries for constructing queries from untrusted inputs
such as parameters to web apps, that send text-based SQL to the
database, and that automatically filter the input (eg using regexps) to
prevent SQL injection attacks?  In particular, do these prepared
statement libraries filter out inputs that include quotes and other
nasties, by default?

Andy