security - Restrict semicolon to prevent SQL injection? -

-

i've seen sql injection strings constructed this:

' ; drop database db  --

therefore, if disallow use of semicolons in application's inputs, 100% prevent sql injection attack?

no not prevent sql injection attacks. time you're dynamically constructing sql either in client side, or exec inside stored proc, @ risk.

parameterized queries preferred way input query.


Comments

Post a Comment

Popular posts from this blog

python - Why doesn't list have safe "get" method like dictionary? -

-
>>> d = {'a':'b'} >>> d['a'] 'b' >>> d['c'] keyerror: 'c' >>> d.get('c', 'fail') 'fail' >>> l = [1] >>> l[10] indexerror: list index out of range ultimately doesn't have safe .get method because dict associative collection (values associated names) inefficient check if key present (and return value) without throwing exception, while super trivial avoid exceptions accessing list elements (as len method fast). .get method allows query value associated name, not directly access 37th item in dictionary (which more you're asking of list). of course, can implement yourself: def safe_list_get (l, idx, default): try: return l[idx] except indexerror: return default you monkeypatch onto __builtins__.list constructor in __main__ , less pervasive change since code doesn't use it. if wanted use lists created own code subclas...
Read more

razor - Is this a bug in WebMatrix PageData? -

-
i think may have found bug in webmatrix's pagedata, not sure. concerns how pass data partial page calling page. in webmatrix documentation (tutorials, e.g. " 3 - creating consistent look ", , example code), pagedata recommended mechanism pass data between pages (e.g. content page layout page, or partial page). however have found not work other way, pass data partial page calling page. modifying or adding entries in pagedata in partial page, not seem calling page. cutting right down simplest possible example, in test page may have this: @{ pagedata["test"] = "initial entry"; } <p>before calling partial page, test value @pagedata["test"]</p> @renderpage("_testpartial.cshtml") <p>after returning calling page, test value @pagedata["test"]</p> and in _testpartial.cshtml page might have this: @{ pagedata["test"] = "modified entry"; } <p>in partial page...
Read more

sql server - Stored procedure -

-
how type of return value in stored procedure. , difference between them. please explain me. typically stored procedures expect dataset. if looking way single values type of query, might better suited making udf (user defined function). nonetheless, here how can create stored procedure output variable create procedure dbo.getnamebyid ( @id nvarchar(50), @personname nvarchar(50) output ) select @personname = lastname person.contact id = @id with procedure, can execute follows. declare @name nvarchar(50) exec dbo.getnamebyid @id = 'a123fb', @personname = @name output select name = @name good luck.
Read more