Re: [Info-ingres] RES: [Info-ingres] RES: [Info-ingres] SQL Injection attacks

Emiliano wrote:
Leandro Pinto Fava wrote:

In our case the problems were in the application layer.
HTML injection?

No, when I said application layer, I wanted to say the problem was not
in database server.

SQL injection attacks are *always* in the application layer. The database server is never culpable; SQL injection attacks are the situations where the DB server does as it's told correctly, but is presented with a query which is not as intended by the app programmers. It's a logical failure, not a technical failure.

Emile
Emile,

I'd almost agree if it weren't for stored procedures. I'm not sure if
I could manage a SQL injection attack with Ingres' limited stored procedure
language, but Oracle certainly has experienced a number of attack vectors
vi PL/SQL packages.

Whether or not that is considered "the database" is another matter.

Cheers,

Mike Leo


begin:vcard
fn:Michael Leo
n:Leo;Michael
org:Caribou Lake LLC
adr:Suite 100;;8401 Golden Valley Drive;Minneapolis;MN;55427;United States
email;internet:mleo@xxxxxxxxxxxxxxx
x-mozilla-html:FALSE
url:http://www.cariboulake.com
version:2.1
end:vcard

Relevant Pages

  • Re: [Info-ingres] RES: [Info-ingres] RES: [Info-ingres] SQL Injection attacks
    ... HTML injection? ... database server is never culpable; SQL injection attacks are the situations where the DB server does as it's told correctly, but is presented with a query which is not as intended by the app programmers. ... It's a logical failure, not a technical failure. ...
    (comp.databases.ingres)
  • Re: LINQ Queries vs Stored Procs
    ... Procedures, you can limit the user to only executing stored procedures, ... assign the minimally-necessary permissions on the stored procedures. ... procedures eliminate most sql injection attacks, ... with dynamic sql. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Complex Database Transactions
    ... My take is that stored procedures can still offer a performance improvement in many cases. ... "As a database is changed by such actions as adding indexes or changing data ... A much better option would be to have the database server compile the query, ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: Client-dataset-like components that work the same?
    ... use stored procedures in case you want to manipulate the data (what would ... otherwise be the point to retrieve all those records) ... middle-tier (which could be on the database server, ...
    (borland.public.delphi.thirdpartytools.general)
  • Re: how to deploy stored procedures onsite
    ... You will need to have an access to the database server with enough rights ... You, or your customer, need to talk to IT ... That's the down side of using stored procedures. ... > script on customers sites? ...
    (microsoft.public.dotnet.framework.aspnet)