I presented a webinar today about SQL Injection, to try to
clear up some of the misconceptions that many other blogs and
articles have about this security risk. You can register
for the webinar even now that I’ve presented it, and you’ll be
emailed a link to the recording, which will be available soon.
During my webinar, a number of attendees asked some good
questions, and I wasn’t able to answer them all before the hour
was up. Here are the questions and my answers.
Tobin C. asked:
Q: Does the use of Parameters (particulary OdbcParameter
class in .NET) qualify as an appropriate security mechanism for
normal WHERE interpolation? Or should the input be validated
before creating a parameter?
Yes, the OdbcParameter class should be safe. The
OdbcParameter abstracts query …
[Read more]