Alex Rivera | Logout

Can parameterized statement stop all SQL injection?

Asked 2011-07-22T05:31:11.460
98

If yes, why are there still so many successful SQL injections? Just because some developers do not use parameterized statements?

sql prepared-statement sql-injection code-injection exploit
Edit
Report

1 Answer

1

To protect your application from SQL injection, perform the following steps:

Step 1. Constrain input. Step 2. Use parameters with stored procedures. Step 3. Use parameters with dynamic SQL.

Refer to http://msdn.microsoft.com/en-us/library/ff648339.aspx

answered 2011-07-22T05:37:47.360

Your Answer