Quote:
Originally Posted by DrBunchman
Hi zensunni,
You've obviously done some research on this already and correctly found that the most dangerous characters are the end of line (";"), comment ("--") and single quote mark("'") as these allow people to manipulate your SQL strings with greatest ease. You could add UPDATE, SHUTDOWN & EXEC (to prevent the execution of stored procedures) to your list for additional safety.
For the HTML check you've probably covered most bases by not allowing the opening and closing tags thus preventing anyone from dropping script into your page. Anybody else got any views on this one?
Hope this helps,
Dr B
That covers all the bases I can think of, but there are some alternative techniques you can try:
1- open a recordset - most injections will cause an error if used on a recordset
2- use only stored procedures - most injections are harmless if you don't execute SQL commands. Since stored procedures are not really SQL commands but instructions to execute a list of pre-compiled commands, it is highly unlikely that an injection could get through.
Jared
