We've been experiancing some SQL Injection problems and I have opted to create a function to strip out apostrophies among other SQL commands, however out DBA suggested that instead of using .execute to run out SQL statements he suggested using the rs.Open sqlStr, dbConn, 3, 3 method which he calls "SQL Parameters" and that method insures against SQL Injections.
I was unable to Google any answers because "SQL Parameter" is not the correct way of calling this method. Nor is call the .execute method "Inline SQL."
My question is, what are these methods called so I can Google the answers, and what's the difference between the two.
Thanks!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I would strongly recommend using stored procedures and parameters in ASP. It helps reduce the SQL injection problems even more. Once you get the hang of using stored procedures, they are very easy to use.
Here is a link that talks about it: http://aspalliance.com/385
Business Accounts
Answer for Membership
by: cmhuntyPosted on 2008-03-18 at 08:43:41ID: 21152248
Hi
SQL parameters are a very good preventative measure for SQL Injection. "SQL Parameters" in Google produces this link: https://mbs.microsoft.com/
Stripping out apostrophes won't necessarily work. Consider the following example for a SQL command string:
"SELECT * FROM CreditCards WHERE CardID = " & cardID
Now setting cardID to "1 OR 1=1" will produce the string
SELECT * FROM CreditCards WHERE CardID = 1 OR 1=1
and all results will be returned.
In this example, SQL Parameters will prevent this attack.