Neil Carpenter's Blog

Forefront products, WSUS, Security Incident Response, and whatever else comes up.

Browse by Tags

Related Posts
  • Blog Post: SQL Injection Mitigation: Using Parameterized Queries

    Michael Howard wrote an excellent article yesterday on how the SDL addresses SQL injection . He walks through three coding requirements/defenses: Use SQL Parameterized Queries Use Stored Procedures Use SQL Execute-only Permissions As Michael points out, only the first, parameterized queries...
  • Blog Post: SQL Injection Mitigation: Using Parameterized Queries part 2 (types and recordsets)

    (Part 1 is here ) Previously, I provided a simple example of using parameterized queries in classic ASP; however, that sample lacked a few things such as explicit typing for the parameters. It also created a read-only ADODB.RecordSet which, obviously, isn't one-size-fits-all. Typing In the last...
  • Blog Post: SQL Injection: Trends & Guidance

    I've been working with the SWI team to write a comprehensive overview of the SQL Storm attacks with guidance for IT administrators, developers, and end users.  That article is posted at sql-injection-attack.aspx . For developers, specifically, Bala Neerumalla has written an excellent overview of...
  • Blog Post: SQL Injection Hijinks

    or Why I Keep Harping On Blacklisting Summary: An incident reveals attempts to get around blacklisting by manipulating behavior in ASP, illustrating the weakness of blacklist approaches. A new version of UrlScan is shipping today with a change specifically to address this. Discussion:...