<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="http://blogs.technet.com/utility/FeedStylesheets/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/"><channel><title>SQL Injection Mitigation: Using Parameterized Queries</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx</link><description>Michael Howard wrote an excellent article yesterday on how the SDL addresses SQL injection . He walks through three coding requirements/defenses: 
 
 Use SQL Parameterized Queries 
 Use Stored Procedures 
 Use SQL Execute-only Permissions 
 As Michael</description><dc:language>en-US</dc:language><generator>Telligent Evolution Platform Developer Build (Build: 5.6.50428.7875)</generator><item><title>SQL Injection Hijinks</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3145517</link><pubDate>Sat, 01 Nov 2008 03:02:28 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3145517</guid><dc:creator>Neil Carpenter's Blog</dc:creator><description>&lt;p&gt;or Why I Keep Harping On Blacklisting Summary: An incident reveals attempts to get around blacklisting&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3145517" width="1" height="1"&gt;</description></item><item><title>How IAG 2007 Can Mitigate SQL Injection Attacks – Demo Scenario</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3126195</link><pubDate>Fri, 19 Sep 2008 21:52:16 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3126195</guid><dc:creator>Intelligent Application Gateway Product Team Blog</dc:creator><description>&lt;p&gt;1. Introduction SQL Injection is a potential threat to any web application that has a SQL based database&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3126195" width="1" height="1"&gt;</description></item><item><title>SQL Injection, the threat beyond the perimeter</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3119896</link><pubDate>Fri, 05 Sep 2008 18:03:08 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3119896</guid><dc:creator>Yuri Diogenes's Blog</dc:creator><description>&lt;p&gt;It is very common to us from CSS Security receive calls about SQL Injection and sometimes customers prefers&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3119896" width="1" height="1"&gt;</description></item><item><title>Input Validation Is Not The Answer</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3102266</link><pubDate>Thu, 07 Aug 2008 21:27:12 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3102266</guid><dc:creator>Neil Carpenter's Blog</dc:creator><description>&lt;p&gt;I just sent a piece of e-mail to my team about input validation and SQL injection and it occurred to&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3102266" width="1" height="1"&gt;</description></item><item><title>SQL注入攻击-来自微软安全博客的建议</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3066257</link><pubDate>Thu, 05 Jun 2008 06:09:02 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3066257</guid><dc:creator>Applelure</dc:creator><description>&lt;p&gt;本文翻译自微软博客上刊载的相关文章，英文原文版权归原作者所有，特此声明。（特别感谢NeilCarpenter对本文写作提供的帮助）&lt;/p&gt;
&lt;p&gt;近期趋势&lt;/p&gt;
&lt;p&gt;从去年下半年开始，很多网站被损害，他们在用于生成动...&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3066257" width="1" height="1"&gt;</description></item><item><title>Microsoft Best Practices for preventing SQL Injection Attacks</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3064417</link><pubDate>Sun, 01 Jun 2008 06:42:42 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3064417</guid><dc:creator>Harry Waldron - My IT Forums Blog </dc:creator><description>&lt;p&gt;Microsoft has recently published a series of best practices to help developers build SQL code that is&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3064417" width="1" height="1"&gt;</description></item><item><title>SQL injection information from Harry's blog</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3064273</link><pubDate>Sat, 31 May 2008 19:17:05 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3064273</guid><dc:creator>MVPs</dc:creator><description>&lt;p&gt;While the default apps on a SBS 2003 (and upcoming SBS 2008) go through a SDL process so that I&amp;amp;#39;m&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3064273" width="1" height="1"&gt;</description></item><item><title>SQL injection information from Harry's blog</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3064266</link><pubDate>Sat, 31 May 2008 18:31:57 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3064266</guid><dc:creator>THE OFFICIAL BLOG OF THE SBS "DIVA"</dc:creator><description>&lt;p&gt;While the default apps on a SBS 2003 (and upcoming SBS 2008) go through a SDL process so that I&amp;amp;#39;m&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3064266" width="1" height="1"&gt;</description></item><item><title>Microsoft Best Practices for preventing SQL Injection Attacks</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3064225</link><pubDate>Sat, 31 May 2008 15:58:46 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3064225</guid><dc:creator>Harry Waldron - Microsoft MVP Blog</dc:creator><description>&lt;p&gt;Microsoft has recently published a series of best practices to help developers build SQL code that is&lt;/p&gt;
&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3064225" width="1" height="1"&gt;</description></item><item><title>http://blogs.technet.com/swi/archive/2008/05/29/sql-injection-attack.aspx</title><link>http://blogs.technet.com/b/neilcar/archive/2008/05/21/sql-injection-mitigation-using-parameterized-queries.aspx#3063718</link><pubDate>Fri, 30 May 2008 21:12:46 GMT</pubDate><guid isPermaLink="false">d5e57398-b9ef-4490-9955-07cbb4e4a80d:3063718</guid><dc:creator>TrackBack</dc:creator><description>&lt;img src="http://blogs.technet.com/aggbug.aspx?PostID=3063718" width="1" height="1"&gt;</description></item></channel></rss>