Re: Current Project Design, Comments?

["Kevin Spett" <kspett () spidynamics com>]

Hmmm... a hot week for SQL injection questions.  Simply use Prepared
Statements, Stored Procedures and Command Objects to access the database.
No "string built" queries.  The easiest way to enforce and test this is to
make sure that the *only* thing the web app's DB user has access to is a set
of stored procedures... It shouldn't even be allowed to run arbitrary SELECT
statements on relevent tables.

BTW, could you throw out a link to said whitepaper?



Kevin Spett
SPI Labs
http://www.spidynamics.com/

> Pretty standard in the web world, correct?  I am still trying to figure
out
> a universal way to handle SQL injections.  I garnered most of this from
> Microsoft's whitepaper on secure ASP.NET applications.
>
>
> --
> Michael Loll
> Consultant / Pointe Technology Group, Inc.
> mloll () pointetech com / www.pointetech.com
>
>
> * This email is my opinion and not that of my employer.