RE: Current Project Design, Comments?

[Michael Loll <mloll () pointetech com>]

Kevin,

Try this:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht
ml/secnetlpMSDN.asp

Yes, I'm only using Stored Procedures for data access/updating.  Any time a
user wishes to touch the database it will be through our application, no
where else.  Though I guess an Oracle administrator COULD do whatever they
wanted, but you can't stop that.

-----Original Message-----
From: Kevin Spett [mailto:kspett () spidynamics com] 
Sent: Friday, February 14, 2003 4:03 PM
To: Michael Loll; webappsec () securityfocus com
Subject: Re: Current Project Design, Comments?


Hmmm... a hot week for SQL injection questions.  Simply use Prepared
Statements, Stored Procedures and Command Objects to access the database. No
"string built" queries.  The easiest way to enforce and test this is to make
sure that the *only* thing the web app's DB user has access to is a set of
stored procedures... It shouldn't even be allowed to run arbitrary SELECT
statements on relevent tables.

BTW, could you throw out a link to said whitepaper?