309 reputation
29
bio website chris-walton.blogspot.com
location United Kingdom
age 64
visits member for 3 years, 5 months
seen Nov 25 at 12:33

Retired IT Strategy Analyst now developing systems as a pastime.


Jul
28
awarded  Critic
Jul
26
comment How to guide stakeholder(s) not to get far from the scrum vision?
Stakeholders are not there to meet the scrum vision - the scrum vision is there to support the stakeholders, and their requirements in an effective manner.
Jul
24
revised Is reliance on parametrized queries the only way to protect against SQL injection?
Expanded question.
Jul
24
answered The difference between best practices and common sense?
Jul
21
awarded  Teacher
Jul
21
answered Laptops or Notebooks in a meeting?
Jul
21
comment Is reliance on parametrized queries the only way to protect against SQL injection?
+1 for comprehending my actual query in the light of my implicit, unconscious assumptions, and for responding to it appropriately. As for why one might bother - I am working on a project where much of the code will be generated from a relevant description of the architecture - and part of this architecture describes how to generate database access routines. It is still open as to what shape these generated routines will take.
Jul
21
comment Is reliance on parametrized queries the only way to protect against SQL injection?
@Jon - I have altered the title of the question, and made some edits to the question, in the light of Craig's correction. I was not aware of the assumption I was making in the question, until I started receiving replies.
Jul
21
revised Is reliance on parametrized queries the only way to protect against SQL injection?
Emphasis of the question changed, in the light of the initial responses received. Base question unchanged.
Jul
21
awarded  Editor
Jul
21
revised Is reliance on parametrized queries the only way to protect against SQL injection?
Additional information.
Jul
21
comment Is reliance on parametrized queries the only way to protect against SQL injection?
+1 for roles. They are a major contributor to this - I did not include roles in my question, but they were a part of the setup - in particular the views were assigned a restricted role such as you suggest for clients. Point taken on the performance hit of views. Domains included validation tests - ranges and length mostly. Your comments on the data nullable rule are much more polite than some I heard about this rule. I did not state explicitly that the permissions would be set up appropriately though this was my assumption.
Jul
21
awarded  Supporter
Jul
21
awarded  Student
Jul
21
comment Is reliance on parametrized queries the only way to protect against SQL injection?
Thank you for the focus on parameterised queries, rather than procs. However, I am asking whether the database can be protected by methods other than by such queries - in particular methods that are confined to the database layer only.
Jul
21
asked Is reliance on parametrized queries the only way to protect against SQL injection?
Jul
20
awarded  Autobiographer