3
votes
0answers
21 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
0
votes
4answers
486 views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
3
votes
1answer
382 views

Should we bother with cell-level encryption for an ASP.NET/SQL Server web application?

(Cross-posting this here on the advice of a user at stackoverflow...) Got a philosophical security question for everyone. I'm sketching out an ASP.NET web application design where sensitive data for ...
3
votes
2answers
349 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
1
vote
1answer
438 views

Setting up ASP.NET web application on internet for first time; Are these security measures enough?

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities). This application ...
4
votes
2answers
699 views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
1
vote
1answer
254 views

Safe to store access details in a session?

Background I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static ...
2
votes
4answers
2k views

Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?

I'm working in a web site that doesn't use parameters on SQL queries. All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
9
votes
4answers
531 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...