107

No. You might be confusing SQL injection with data injection; read-only tables do not prevent SQL injection and at best do only a little to limit its impact. SQL injection simply means the ability to inject SQL code. While read-only tables may limit the ability to inject data into the table, they don't impact the ability to: Read from other databases or ...


15

By default the database communications are unencrypted and vulnerable to sniffing. To utilize encryption, you need to configure the SQL server with a certificate and then configure the client to take advantage of it. There's a pretty simple walkthrough for the process here


15

If you are interested in using column level encryption in SQL Server 2005 and higher I have a bunch of sample code of how to use the built in encryption features in SQL Server to secure sensitive data. The code is all available at http://sqlcrypto.codeplex.com/ In the code I show how to encrypt sensitive data and ensure that only authorized users can ...


15

No, it's not necessary. But please, read on. Input sanitization is a horrible term that pretends you can wave a magic wand at data and make it "safe data". The problem is that the definition of "safe" changes when the data is interpreted by different pieces of software. Data that may be safe to be embedded in an SQL query may not be safe for embedding in ...


14

Yes, you need at least 14 bits to generate a number between 0 and 9999. In order to avoid bias, you can generate 14 bits of random data using a good source of randomness. If the result is <= 9999, then you can use it as your PIN. If the result is bigger, throw it away and try again. How much does this waste? In the best possible case, your bits would ...


13

No, trivial example EXEC ('SELECT COUNT(*) FROM table WHERE UserName =''''' + @UserName + ''''' AND Password = '''''+@Password+'''''') Set @Password to a' OR 1=1;-- And your password gets bypassed


12

SQL Server has the option to encrypt the connection between application and database. When you operate SQL server in an untrusted environment, it is recommended that you enable it. When you do, hashing the passwords before sending them to the database is unnecessary as long as you trust your DB administrator. Additionally, most deployments of SQL server ...


12

Does a least-privilege (select ability on one table only), read-only connection to the database prevent all injection attacks? SQL injection is a way for an attacker to modify an existing statement so that it causes unintended actions. These actions might be changes on the database or code execution on the system but also simply returning data it should not ...


10

gowenfawr suggestion is partially wrong on this one. Your initially connection (username and password) to SQL Server may or may not pass your username in clear text. This can depend on what connection type you use (ODBC, OLE DB, etc). Your password is always passed in encrypted format by SQL Server. Now your data itself from the queries being passed will ...


9

Edit: For Microsoft SQL Server specific information, read @Joe's comment below. Also, I expect while the feature you describe encrypts the binlogs (or similar, as in for intrusion to the filesystem), it would probably not help if someone gained access to the data using SQL injection, because of the automatic nature of the decryption. I think you should ...


9

There are two main (security) reasons to do this, above and beyond just using parameterized queries: Parameter type enforcement Least privilege. The principle of Least Privilege requires you to allow any entity (user or application) access only to whatever it needs to do the defined task. If you don't restrict the webapp only to the SPs, the ...


9

"Encrypted connections" to SQL Server use SSL. That's about as good as you can get. Remember, though, that SSL protects only the connection, i.e. the data as it transits between the client and the SQL Server. It does nothing about how the data is stored on the server. It also does nothing about isolating connected clients from each other; that part is ...


9

Trust no one. Use secure strings to hold plain text passwords and hash them immediately. Gone are the times when you can hope your system is secure. It is not. It's just matter of time/money until a determined attacker can access your system. Even when traffic gets encrypted with SSL/TLS I can come up with several scenarios, each leading to passwords leak, ...


9

(Adding a new answer which should be definitive, leaving the old around as it's useful debug for how we got here. Credit for pointing to the actual answer in comments goes to @P4cK3tHuNt3R and @dave_thompson_085) Using Wireshark, I am trying to determine the version of SSL/TLS that is being used with the encryption of data between a client workstation ...


9

If I use fully parameterized queries everywhere, is it still necessary and/or security-relevant to somehow sanitize input? Yes. It's always a good idea to sanitize the input before sending it to the database. Parameterized queries might save you from SQL injection attacks, but might not prove beneficial in case of stored XSS attacks. If a user sends a ...


9

First of all, I totally agree with MechMK1 on the proper algorithm to generate cryptographically secure uniformly distributed random number between 0 and 10000. However: there's no reason not to think about the problem with security in mind Lets. Random number between 0 and 10000 contains 13.29 bits of entropy. Random number between 0 and 2^14 % 10000 ...


8

Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL Server and/or database(s) as needed to perform the actions they need to perform. SQL Authentication is a legacy authentication mechanism that in a properly ...


8

TL;TR: these are not problems of the database. Maybe you are using a wrong architecture for your hidden service. And regarding the additional information after the edit of the question see at the end of this answer. What SQL database software should I use for the best security on my site? IE to prevent SQL injections and other vulnerabilities etc. SQL ...


7

Doing this sort of blacklisting of words in your arguments is unnecessary with properly implemented stored procedures, and will only lead to bad user experience in the event that this misfires on benign content. If you are using a stored procedure and structuring your query with the parameters that are passed into the stored procedure, you do not need to do ...


7

SQL Server does not prevent XSS. XSS would still be possible via issues in the web application code. Proper use of prepared statements with SQL Server can prevent SQLi, but to prevent XSS, you must validate data received from untrusted sources and encode data before returning it in an HTTP response.


7

In MySQL, the # symbol can be used as a comment marker. Quote marks in comments don't have to balance. Not all SQL instances run on Microsoft databases.


6

Sounds like that's the padding oracle attack that came out in 2010. You should check your server for the appropriate MS patch (MS10-070). There's more information on the attack here


6

I think the answer to your question pivots on a slightly different perceptual view - which is, where does the decryption take place? Technologies like TDE function at the database level. In practical terms, this often means that a DBA - or someone who has compromised appropriate privileges - can access the decrypted data and structure. Cell-level ...


6

There are cases of SQL Injections leveraging the implicit conversion of Unicode homoglyphs from Unicode character string types (NCHAR, NVARCHAR) to character string types (CHAR, VARCHAR). A character such as ʼ (U+02BC) in NVARCHAR may slip through the escaping routine and get translated to ' (U+0027) in VARCHAR, which may result in an SQL Injection when such ...


6

When they say that, they are probably referring to the number of published exploits and vulnerabilities for their product. If true, this is a very, very bad idea. I'm actually surprised it says that. Published exploits are not an indicator of a product's security. They only indicate how much and many people are looking for exploits. In the worst case, these ...


5

No. This will certainly not handle string concatenation that is not delimited by quotes. e.g. a numeric field. Consider sql= "select username from users where id=" + id if id is provided as 1 or 1=1 then all rows from the database can be returned. Obviously this can example could be extended to union select attacks or even entire nested queries. Just use ...


5

If you store the information in the session, it might get outdated wrt. to the database. That is, if module ownership expires, or it can be cancelled through other means, it might still be present in someone's session. Whether that's a problem or even a feature, is up to you. However, this is "premature optimization". Unless you can prove (prove!) that this ...


5

Using SQLMap will be helpuf, since it scan for most well-known vulnerabilities and will save you some time and efford. But, the greatest threat is a hackers' imagination and ability to exploit something more complex and unusual than SQLMap can find. For me, the best way to check for sql injection vulnerabilities - and even more types of vulnerabilities - is ...


5

In a generic sense neither internal nor external hosting are inherently more or less secure on their own. Ultimately it's just a different set of trade-offs. In both situations the amount of security controls, how they are integrated, how they are managed, and response to events could theoretically be the same regardless of location. There is a small edge ...


4

Cryptography is often not the problem. In most cases encrypting the entire database is almost certainly a waste of time. There are often very important values that should be encrypted. An a value that is often overlooked is the session id, csrf tokens, the password salt and forgotten password token. If you are foolish enough to store your session id in ...


Only top voted, non community-wiki answers of a minimum length are eligible