New answers tagged security
0
votes
Is this SQL Procedure "injection proof"?
Further to the answers above indicating that how one calls the procedure is what is most important, you can make this procedure more secure against SQL injection by:
make all tables and views no ...
- 101
3
votes
Is this SQL Procedure "injection proof"?
The procedure itself is fine, it would only be vulnerable if you were doing some kind of sql generation and execution inside it. You are however correct that you are doing the attack incorrectly, ...
- 408
7
votes
Is this SQL Procedure "injection proof"?
It's not enough that just the stored procedure is injection-proof. The code that calls the sproc must be secure too.
As a trivial counterexample, consider the following C# code that calls your sproc:
...
- 2,796
2
votes
Is this SQL Procedure "injection proof"?
No.
Injection can only happen with dynamic sql.
Dynamic SQL uses one of those 2 statements:
exec @querystring
sp_executesql ....
Your proc has none of these, it is thus not dynamic, it is thus not ...
- 435
14
votes
Accepted
Is this SQL Procedure "injection proof"?
SQL injection requires that the malicious content be added to (injected into) an SQL query string, which is then parsed by the database engine and executed. As a result, anything that looks like a ...
- 23.8k
4
votes
Is this SQL Procedure "injection proof"?
With dynamic SQL, you first build the SQL statements and then execute them in a later step. But in this case, you are passing parameters to your query. When you execute this statement "EXEC test @...
- 149
0
votes
Is there a way for mongodb clients to connect to mongodb server (SSL/TLS enabled) without client certificates?
Yes, you can set net.tls.allowConnectionsWithoutCertificates: true
Of course, net.tls.mode must not set to requireTLS, use preferTLS or allowTLS
Encryption of connection is provided by server ...
- 2,667
Top 50 recent answers are included