Re: Antitoxin for "SQL Injection" (?)

[James Tucker <jftucker () gmail com>]

Creative programming combined with the use of stored procedures can
reduce the need (even in some cases, with careful interface design
erradicate completely) the need to use any procedures which could ever
be built for injection.

Of course if you're looking for a sure fire solution every time, use a
database wrapper and translate statements more aggressively to your
application specification. Particularly in the web world you can
generally present information views which will be sufficiently
translatable by careful use of tuple mapping and proper escaping
practices.

Devdas eclaimation was however correct as there are non-security
related reasons to program your applications properly anyway, and
stored procudures are also generally a default choice for most web
applications, particularly public sites.

On 02/01/06, Sen, Adem <asen-public () sage de> wrote:
> Hi Devdas,
>
> Do STORED PROCEDURES really protect against any kind of SQL Injection? I
> have read many articles about, some say they are and some say they are
> NOT!
>
> Isn't there any way to do code injection into a SP or are they
> fully-secure against Injections?
>
> I think it is clear, that SP's make your web-app less dynamic?
>
> Thanks!
> Adem Sen
>
>
> > Devdas wrote:
> > Ugh! Why do you not use stored procedures and bind parameters, which
> is
> > the right way to do it?
> >
> > Devdas Bhagat
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/