Developers Cloud

An SQL injection attack consists of insertion or "injection" of an SQL query via the input data from the client to the application. Attackers potentially use SQL Injection to: -Logging into your applicatiob by Bypassing the authentication. -Gaining access to your sensitive information in the database. -Tampering or destroying data. There are two complementary and successful methods of mitigating SQL Injection attacks: -Parameterized queries using bound, typed parameters. -Careful use of parameterized stored procedures. So one common use of such queries is explained in the below example written in Dot Net, which uses Parameterized queries for the variables declared with initial @. And also you can avoid the error caused by Apostophe (') in the variable if you are updating a table. Like if you have a variable like O'Connor then you app will throw an error, which can be avoided by the use of Parameterized query. It is one of the best way to avoid h...

The problems in C are not confined to just the language. Some routines in the standard library have  unsafe semantics. This was dramatically demonstrated in November 1988 by the worm program that wriggled through thousands of machines on the Internet network. When the smoke had cleared and the investigations were complete, it was determined that one way the worm had propagated was through a weakness in the finger daemon, which accepts queries over the network about who is currently logged in. The finger daemon, in.fingerd, used the standard I/O routine gets(). The nominal task of gets() is to read in a string from a stream. The caller tells it where to put the incoming characters. But gets() does not check the buffer space; in fact, it can't check the buffer space. If the caller provides a pointer to the stack, and more input than buffer space, gets() will happily overwrite the stack.  The finger daemon contained the code: main(argc, argv) char *argv[]; { ...