meta user
network profile
| bio | website | chris-walton.blogspot.com |
|---|---|---|
| location | United Kingdom | |
| age | 63 | |
| visits | member for | 1 year, 10 months |
| seen | May 4 at 12:42 | |
| stats | profile views | 24 |
Retired IT Strategy Analyst now developing systems as a pastime.
|
Jul 24 |
answered | The difference between best practices and common sense? |
|
Jul 21 |
awarded | Teacher |
|
Jul 21 |
answered | Laptops or Notebooks in a meeting? |
|
Jul 21 |
comment |
Is reliance on parametrized queries the only way to protect against SQL injection? +1 for comprehending my actual query in the light of my implicit, unconscious assumptions, and for responding to it appropriately. As for why one might bother - I am working on a project where much of the code will be generated from a relevant description of the architecture - and part of this architecture describes how to generate database access routines. It is still open as to what shape these generated routines will take. |
|
Jul 21 |
comment |
Is reliance on parametrized queries the only way to protect against SQL injection? @Jon - I have altered the title of the question, and made some edits to the question, in the light of Craig's correction. I was not aware of the assumption I was making in the question, until I started receiving replies. |
|
Jul 21 |
revised |
Is reliance on parametrized queries the only way to protect against SQL injection? Emphasis of the question changed, in the light of the initial responses received. Base question unchanged. |
|
Jul 21 |
awarded | Editor |
|
Jul 21 |
revised |
Is reliance on parametrized queries the only way to protect against SQL injection? Additional information. |
|
Jul 21 |
comment |
Is reliance on parametrized queries the only way to protect against SQL injection? +1 for roles. They are a major contributor to this - I did not include roles in my question, but they were a part of the setup - in particular the views were assigned a restricted role such as you suggest for clients. Point taken on the performance hit of views. Domains included validation tests - ranges and length mostly. Your comments on the data nullable rule are much more polite than some I heard about this rule. I did not state explicitly that the permissions would be set up appropriately though this was my assumption. |
|
Jul 21 |
awarded | Supporter |
|
Jul 21 |
awarded | Student |
|
Jul 21 |
comment |
Is reliance on parametrized queries the only way to protect against SQL injection? Thank you for the focus on parameterised queries, rather than procs. However, I am asking whether the database can be protected by methods other than by such queries - in particular methods that are confined to the database layer only. |
|
Jul 21 |
asked | Is reliance on parametrized queries the only way to protect against SQL injection? |
|
Jul 20 |
awarded | Autobiographer |
