Skip the navigation  Opinion: No more excuses for SQL injection
attacks  By Kenneth van Wyk September 3, 2009 10:33 AM ET
Computerworld - We should have eradicated SQL injection attacks
by now. SQL injection should be the Internet generation's
smallpox or polio -- gone for good. Countermeasures are readily
available and understood. They're easy to implement. And yet, I
keep seeing headlines like "Huge Web hack attack infects 500,000
pages."  SQL injection attacks continue to be among the most
fruitful against Web sites and applications. And why not? From
an attacker's perspective, the database behind many Web
applications is where the really juicy targets live. That's
where you'll find customer records, credit card numbers and
other good stuff.  And now attackers have started using SQL
injection to plant malware on Web sites, so that visitors to
those sites get their computers infected with the malware. The
databases aren't just where the juicy targets are; they're ripe
for planting malicious data that infec