Advanced SQL Injection in SQL Server Applications

[article]
Summary:

This document discusses in detail the common "SQL injection" technique, as it applies to the popular Microsoft Internet Information Server/Active Server Pages/SQL Server platform. It discusses the various ways in which SQL can be "injected" into the application and addresses some of the data validation and database lockdown issues that are related to this class of attack. 

This document discusses in detail the common "SQL injection" technique, as it applies to the popular Microsoft Internet Information Server/Active Server Pages/SQL Server platform. It discusses the various ways in which SQL can be "injected" into the application and addresses some of the data validation and database lockdown issues that are related to this class of attack.

The paper is intended to be read by both developers of Web applications which communicate with databases and by security professionals whose role includes auditing these Web applications.

Click PDF below to read the article.

About the author

Chris Anley's picture Chris Anley

Chris Anley is a director at NGSSoftware, the world's leading security vulnerability research company. When he's not spending time auditing software or websites for security bugs, he writes whitepapers that help folks do it for themselves. You can read more about NGSSoftware here.

AgileConnection is one of the growing communities of the TechWell network.

Featuring fresh, insightful stories, TechWell.com is the place to go for what is happening in software development and delivery.  Join the conversation now!

Upcoming Events

Nov 09
Nov 09
Apr 13
May 03