Creative programming combined with the use of stored procedures can reduce the need (even in some cases, with careful interface design erradicate completely) the need to use any procedures which could ever be built for injection.
Of course if you're looking for a sure fire solution every time, use a database wrapper and translate statements more aggressively to your application specification. Particularly in the web world you can generally present information views which will be sufficiently translatable by careful use of tuple mapping and proper escaping practices. Devdas eclaimation was however correct as there are non-security related reasons to program your applications properly anyway, and stored procudures are also generally a default choice for most web applications, particularly public sites. On 02/01/06, Sen, Adem <[EMAIL PROTECTED]> wrote: > Hi Devdas, > > Do STORED PROCEDURES really protect against any kind of SQL Injection? I > have read many articles about, some say they are and some say they are > NOT! > > Isn't there any way to do code injection into a SP or are they > fully-secure against Injections? > > I think it is clear, that SP's make your web-app less dynamic? > > Thanks! > Adem Sen > > > > Devdas wrote: > > Ugh! Why do you not use stored procedures and bind parameters, which > is > > the right way to do it? > > > > Devdas Bhagat > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
