Re: SQL Injection

[Richard Creer]

Rick

Thanks for that but I believe I am correct in saying that mysql_real_escape_string / mysqli_real_escape_string are php only whereas for my sins I use asp.net.

As to your other points you are quite right, if you give users the ability to write and execute their own SQL then you will need to apply a much higher level of validation. For instance in your example of LIMIT you need to prevent people writing LIMIT = ten because that is another syntax error.

But I suggest that it would be unwise to design a system which allows users to write and execute their own SQL against a database containing information that they are not supposed to see.

So I remain perplexed and look forward to a real example how SQL injection can be achieved in properly written code which creates dynamic SQL.