Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
alxtech
Yak Posting Veteran
66 Posts |
 Posted - 2007-10-25 : 11:07:45
|
| Hello forum:In my application, asp form to search records in database depending on user input, I have three main input boxes: zipcode, proNumber, testNumber. all three inputs get numeric caracthers with max length of 5.Question: to prevent SQL Injection, it is enough to restrict users through form validation to input only numbers 0-9 and a (.) with a max length of 5? |
|
|
SwePeso
Patron Saint of Lost Yaks
30421 Posts |
Posted - 2007-10-25 : 11:09:20
|
No.Please use proper parameter approach by using COMMAND object!
E 12°55'05.25"N 56°04'39.16" |
 |
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2007-10-25 : 11:09:42
|
| no.use parameteres!or replace one single quote to two single quotes._______________________________________________Causing trouble since 1980blog: http://weblogs.sqlteam.com/mladenpSSMS Add-in that does a few things: www.ssmstoolspack.com |
|
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2007-10-25 : 11:10:04
|
 22 seconds  _______________________________________________Causing trouble since 1980blog: http://weblogs.sqlteam.com/mladenpSSMS Add-in that does a few things: www.ssmstoolspack.com |
|
|
|
SwePeso
Patron Saint of Lost Yaks
30421 Posts |
|
|
|
|
|
SQL Injection