SQL injection on Classic ASP pages with parameterized queries: text fields

Question

I've parameterized my queries in my Classic ASP app, but am unsure whether I need to sanitize or scrub free text fields or if the parameterization is sufficient to prevent injection.

You can always try to inject your own SQL injections to see how it behaves. — luiscubal
– luiscubal, Commented Jan 21, 2010 at 22:04

Rubens Farias · Accepted Answer · 2010-01-21 22:03:43Z

6

If you use parametrized queries, you're safe against SQL injection attacks.

But not for XSS attacks; some user could to insert HTML content (think about <script>, <object> tags) into your database and, at some page, another user get that potentially malicious code executed.

answered Jan 21, 2010 at 22:03

Rubens Farias

58k8 gold badges136 silver badges165 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Aykut Akıncı · Accepted Answer · 2010-01-21 22:05:51Z

2

Not all sql stored procs are injection safe

http://palisade.plynt.com/issues/2006Jun/injection-stored-procedures/

answered Jan 21, 2010 at 22:05

Aykut Akıncı

1,3021 gold badge7 silver badges8 bronze badges

2 Comments

3Dave Over a year ago

That article uses examples that rely on dynamically-generated SQL. Even though the SQL is generated server-side, this reintroduces the injection vulnerability issue. The lesson here is avoid dynamic SQL in any context.

Caveatrob Over a year ago

Nice discussion of ExecuteSQL, which has to be handled in particular ways for security as well (have to make sure to sign particular procedures so that you don't use DBO as the runner of the procedure).

Collectives™ on Stack Overflow

SQL injection on Classic ASP pages with parameterized queries: text fields

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related