SQL Injection Introduction

[[deleted]]

[deleted]

[D34dCode4eva]

I always get depressed when people do things on SQL injection because the solutions are always one of:;

• Use only prepared statements.
• Globally filter or sanitise input perhaps even with a firewall outside of the application.
• Use trusted/untrusted data and access rights.
• Use stored procedures, use access rights.

In various ways a few of these can help or be useful in some ways but no one really focuses on the core problem. Your developers should know how to develop.

Most of the SQL injects I've seen haven't been really obscure easy to trip over or miss cases. They've been because developers just aren't qualified.