Jeff Smith Blog

Random Thoughts & Cartesian Products with Microsoft SQL Server

Vulnerable to SQL Injection?

Fri Apr 21, 2006 by Jeff Smith in t-sql, techniques, security

One of the things that troubles me most about SQL Injection is that is seems it is still very misunderstood. Is the following psuedo-code vulnerable to SQL Injection? String SearchTerm = {some user input here, unvalidated and unscrubbed -- uh oh ! Read more →

Some Simple SQL Rules to Live By

Tue Mar 14, 2006 by Jeff Smith in t-sql, techniques, efficiency, sql-server-2005, security

Most of these are really basic. Some are my take on established ideas and standards, and may be controversial. Agree or disagree? All feedback is welcome! (well ... mostly the "I agree, you're a genius" feedback is welcome . Read more →