For a change, a video about security, rather than performance and execution plans. Why? Well, that should become clear in my next planned videos. Although I really can’t predict when I’ll be able to record those.
What is it? And how to prevent it?
In the first approximately 12.5 minutes of the video, I try to explain the concept of what SQL injection is in the most simple and non-technical terms I could come up with. But I also show, in that analogy, what defensive measures do and do not work. And how easy it ultimately is to be safe. In the rest of the video, I then wrap that back to SQL and frontend code.
More of me?
Was this useful to you? Do you want to learn more from me?
You can click here to see an overview of my scheduled conference talks. If you attend one of those, you get a lot of other presenters and sessions thrown in as well!
To learn really everything about SQL Server execution plans, check out my video training. Over 20 hours of super high quality video content (and more will be added when ready).
Or you can hire me to fix the performance problems (and perhaps some security issues too?) on your server, or for in house training.
1 Comment. Leave new
I think a canary table in our test environments could help matters:
USE YourTestDatabase
GO
BEGIN TRY
EXECUTE (N’CREATE TABLE [x;RAISERROR(“SQL INJECTION USING TABLE NAMES!”,17,0);] ([x;RAISERROR(“SQL INJECTION USING COLUMN NAMES!”,17,0);] tinyint)’)
END TRY BEGIN CATCH END CATCH
;
DECLARE @query NVARCHAR(4000) = ”
;
SELECT @query += ‘;SELECT TOP 1 * FROM ‘ + [name]
FROM Sys.tables
–WHERE [name] LIKE ‘%RAISERROR%’
;
PRINT (@query)
;
EXECUTE (@query)
/*
The above could warn us of any unsafe code
that juggles table names or column names.
*/