Beefy Boxes and Bandwidth Generously Provided by pair Networks
DiBona Keep It Simple, Stupid  Re: Detect SQL injection  by
mpeppler (Vicar) on Aug 15, 2010 at 07:41 UTC
( #855130=note: print w/ replies, xml ) Need Help??  in reply to
Detect SQL injection  With Sybase, one of the best ways that
I've found to avoid any risk of SQL Injection is to mandate the
use of stored procedures, and to always use RPC semantics when
calling the stored procedures rather than language commands.
This means that there is no parsing of the input parameters
(other than ensuring that they match with the parameter's
datatypes), so any text that is passed in for a particular
parameter can never be executed.  Another advantage (on large
systems) is that the procs encapsulate all the SQL, making it a
lot easier to find offending (badly performing) queries, and
tuning them independently of the client code.  I realize that
this isn't always practical, but once everyone in the team knows
how this works it's actually quite efficient, in