New answers tagged

0 votes

Is this SQL Procedure "injection proof"?

Further to the answers above indicating that how one calls the procedure is what is most important, you can make this procedure more secure against SQL injection by: make all tables and views no ...
3 votes

Is this SQL Procedure "injection proof"?

The procedure itself is fine, it would only be vulnerable if you were doing some kind of sql generation and execution inside it. You are however correct that you are doing the attack incorrectly, ...
7 votes

Is this SQL Procedure "injection proof"?

It's not enough that just the stored procedure is injection-proof. The code that calls the sproc must be secure too. As a trivial counterexample, consider the following C# code that calls your sproc: ...
  • 2,796
2 votes

Is this SQL Procedure "injection proof"?

No. Injection can only happen with dynamic sql. Dynamic SQL uses one of those 2 statements: exec @querystring sp_executesql .... Your proc has none of these, it is thus not dynamic, it is thus not ...
14 votes
Accepted

Is this SQL Procedure "injection proof"?

SQL injection requires that the malicious content be added to (injected into) an SQL query string, which is then parsed by the database engine and executed. As a result, anything that looks like a ...
  • 23.8k
4 votes

Is this SQL Procedure "injection proof"?

With dynamic SQL, you first build the SQL statements and then execute them in a later step. But in this case, you are passing parameters to your query. When you execute this statement "EXEC test @...
  • 149
0 votes

Is there a way for mongodb clients to connect to mongodb server (SSL/TLS enabled) without client certificates?

Yes, you can set net.tls.allowConnectionsWithoutCertificates: true Of course, net.tls.mode must not set to requireTLS, use preferTLS or allowTLS Encryption of connection is provided by server ...

Top 50 recent answers are included