Mitigating SQL injection in Stored Procedure

Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

All Forums

Development Tools

Other Development Tools

Mitigating SQL injection in Stored Procedure

Author

Topic

rajiv13579
Starting Member

2 Posts

Posted - 2009-07-13 : 02:34:32

Hi All,

I am developing an .net based website which has stored procdeures to exceute the database queries.
As per my understanding from various websites, stored procedures are also vulnerable to SQL injection attack.
Can somebody please share some checklist having exact things to be done/kept in mind while writing and calling stored procedures to protect them from sql injection.
e.g. in input validation we must check for "select, union, delete,update, OR, --, insert, %%,', Grant Control, Print,DROP,!,;,=,+,||,Concat,ASCII,admin,),Having,Group by, order by,NULL,Convert,sum,where,top,waitfor,*,count,<,>" should not be there.

Also use of SQLCommand.commandtype = CommandType.StoredProcedure
with parameter lowers the risk but does it totally removes the risk.

I need these kind of exact checklist which can be passed to SQL development team.

Cheers

TG
Master Smack Fu Yak Hacker

6065 Posts

Posted - 2009-07-13 : 10:26:36

couple things:
Make sure the account your application uses to connect to sql server only has the minimum privs necessary to do the job.
configure server to not allow xp_cmdshell
avoid use of dynamic sql within your SPs and make sure your parameters are all properly typed for the appropriate datatype.

Be One with the Optimizer
TG

TG
Master Smack Fu Yak Hacker

6065 Posts

Posted - 2009-07-13 : 10:30:49

I see there is nearly duped post here:
http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=129200

One post is sufficent - no need to cross post.

Be One with the Optimizer
TG

Subscribe to SQLTeam.com

SQLTeam.com Articles via RSS

SQLTeam.com Weblog via RSS

- Advertisement -

Resources