The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
3answers
59 views

How can I safeguard against SQL injection where parameterizing my query is not an option?

I'm working with ESRI's arcpy module, and I need to specify a WHERE clause as a parameter to this function. Since the result will eventually be used to retrieve data from the database, the text of the ...
0
votes
0answers
55 views

How to protect MySQL database from widespread data theft and modification if SQL injection is successful?

I am looking into a practical defense in depth strategy which helps to limit the damage if, for some reasons, an attacker succeeds in performing an SQL injection. Supposing the website contains ...
-3
votes
1answer
61 views

error querying data with apostrophes [closed]

I'm getting empty sets from running the following query permutations: select * from gsapi_articles where article_title = "James Dean On Merilyn: 'This Woman Is A True Marvel'" select * from ...
2
votes
2answers
175 views

How to restrict users to select only query through application textbox field?

Say that I have a web application that lets users to type in a SQL query (SQL Server 2008+). I want users to be able to run any SELECT query and read whatever is in the database, but I do not want ...
6
votes
1answer
570 views

Postgres functions vs prepared queries

I'm sure it's there but I've not been able to find a simple definitive answer to this in the docs or via Google: In Postgres, are prepared queries and user defined functions equivalent as a ...
2
votes
2answers
113 views

Trace and analyze logs on SQL Server

I am using an SQL Server 2012 on windows datacenter 2012 I have encountered a situation where i think some virus/sql injection had heart my database, Some data on my table had changed to weird ...
0
votes
1answer
310 views

Does this error message indicate a SQL injection vulnerability?

I just took over management for a webservice and today I got a user report about this error. Now I'm no sql injection expert but does this error make this attack possible? Microsoft OLE DB Provider ...
9
votes
3answers
523 views

Is there any way to break out of the string and inject SQL without using a single quote in oracle?

I'm testing an oracle based application and I've found the following code: Query = "SELECT name FROM employees WHERE id='"+PKID+"';" i.e. the query string contains quotes around the PKID value which ...
-1
votes
1answer
846 views

How to protect mysql database from sql-injection?

I am new to databases and security. I am planning to put up a website. I've read that sql-injection vulnerabilities can be very dangerous since the server might leak user passwords and ...
6
votes
2answers
641 views

Why you want to avoid Dynamic SQL in stored procedure?

I have heard one said you do not want to use Dynamic SQL. Can you give some concrete example or real-life example? Personally, I code it a few times in my database. I think it is OK because it's ...
3
votes
1answer
1k views

How can I insert smiley faces into MySQL ( 😊 )

I'm on MySQL 5.5.21, and trying to insert the '\xF0\x9F\x98\x8A' smiley face character. But for the life of me, I can't figure out how to do it. According to various forums which I've been reading, ...
0
votes
0answers
44 views

Database security through stored procedures [duplicate]

Possible Duplicate: Do stored procedures prevent SQL injection? I'm curious about some database security techniques I've been learning in class recently. Namely, I have implemented a SQL ...
8
votes
3answers
811 views

Should date formats be specified in SQL statements?

I see code from developers using implicit date conversion. I would like a definitive answer to why they should not do this. SELECT * from dba_objects WHERE Created >= '06-MAR-2012';
1
vote
0answers
254 views

Regular Expression with UPDATE and SELECT [closed]

Want to use regular expression to execute UPDATE and SELECT query. I want to make regular expression to detect injection attack crack Please suggest.
5
votes
4answers
684 views

Does putting single quotation marks around numeric constants really protect from SQL injection in MySQL?

The manual seems to suggest that using quotes around numbers is sufficient to protect from SQL injection. According to section 5.3.1. General Security Guidelines of the MySQL 5.1 Reference Manual: ...
4
votes
3answers
1k views

Building Dynamic SQL-Server Where Clause

Let us review this dba.exchange Oracle question for SQL-Server. This is SaUce's code, after a little formatting: CREATE PROCEDURE GetCustomer @FirstN nvarchar(20) = NULL, @LastN ...
56
votes
5answers
4k views

Do stored procedures prevent SQL injection?

Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...