full-disclosure - Antitoxin for "SQL Injection" (?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Jan  3 02:45:43 2006
From: jftucker at gmail.com (James Tucker)
Subject: Antitoxin for "SQL Injection" (?)

Creative programming combined with the use of stored procedures can
reduce the need (even in some cases, with careful interface design
erradicate completely) the need to use any procedures which could ever
be built for injection.

Of course if you're looking for a sure fire solution every time, use a
database wrapper and translate statements more aggressively to your
application specification. Particularly in the web world you can
generally present information views which will be sufficiently
translatable by careful use of tuple mapping and proper escaping
practices.

Devdas eclaimation was however correct as there are non-security
related reasons to program your applications properly anyway, and
stored procudures are also generally a default choice for most web
applications, particularly public sites.

On 02/01/06, Sen, Adem <asen-public@...e.de> wrote:
> Hi Devdas,
>
> Do STORED PROCEDURES really protect against any kind of SQL Injection? I
> have read many articles about, some say they are and some say they are
> NOT!
>
> Isn't there any way to do code injection into a SP or are they
> fully-secure against Injections?
>
> I think it is clear, that SP's make your web-app less dynamic?
>
> Thanks!
> Adem Sen
>
>
> > Devdas wrote:
> > Ugh! Why do you not use stored procedures and bind parameters, which
> is
> > the right way to do it?
> >
> > Devdas Bhagat
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>