SQL Injection: Defense in Depth -

SQL Injection happens when a developer accepts user input that is directly placed into a SQL Statement and doesn't properly filter out dangerous characters. This can allow an attacker to not only steal data from your database, but also modify and delete it.

Certain SQL Servers such as Microsoft SQL Server contain Stored and Extended Procedures (database server functions). If an attacker can obtain access to these Procedures it may be possible to compromise the entire machine.

In addition, attackers commonly insert single qoutes into a URL's query string, or into a forms input field to test for SQL Injection. If an attacker receives an error message like the one below there is a good chance that the application is vulnerable to SQL Injection.


Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the
keyword 'or'


The following article talks about how to prevent SQL Injections. I thought it was pretty comprehensive and has good examples on how to achieve a good strategy to minimize these attacks.

http://www.simple-talk.com/sql/learn-sql-server/sql-injection-defense-in-depth/

You can also learn more about it here http://msdn.microsoft.com/en-us/library/ms161953.aspx

Also, there are a few videos that walk you through some of these issues here http://www.google.com/#q=sql+injections+tutorial&hl=en&sa=X&prmd=ivns&source=univ&tbs=vid:1&tbo=u&ei=DGCDTceeN6WY0QG8r7XkCA&ved=0CEcQqwQ&bav=on.2,or.r_gc.r_pw.&fp=3d8c1b5379a812ef