Need some SQL help

[NickFitz]

Excellent!

Google for SQL injection if you're planning on implementing a web-based interface to a database-backed application.

Also worth looking up cross-site scripting, and cross-site request forgery

 

[BrilloPad]

Google for SQL injection if you're planning on implementing a web-based interface to a database-backed application.

Also worth looking up cross-site scripting, and cross-site request forgery

http://www.cgisecurity.com/2007/06/27

Even microsoft have suffered! They should have employed NF...

 

[Cliphead]

Taken onboard. Learning a lot about this and quite happy that things are as secure as they can be at the moment. I don't know much about SQL but I know UNIX and security so that's a good start.

I've also quizzed the developers about their methods and asked for their input re security bit not expecting much feedback...

 

[MrMark]

If your web users are only doing selects on the database, it may be useful practice to make sure their privileges on the database involved are limited to just selects (ie stop them being able to insert update or delete). A belt and braces approach, as you will already be trying to prevent sql injection at application level as mentioned above. The biggest danger is allowing the hacker to gain userid knowledge from the users table at login.