Re: SQL Injection

[Richard Creer]

If you look back to the beginning of this topic you will see that I asked how an SQL injection could occur given good programming practise.

By good programming practise I mean doing no more than those things a programmer must do in order to create reliable SQL which is not prone to synatx errors: putting character strings in single quotes, doubling single quotes within strings, validating numbers and dates.

You will also see that I asked to be enlightened with examples of how SQL injection can happen. To date I have received no such enlightenment. I have also read many articles on the subject none of which have been convincing.

So yes, as far as I can see stories of SQL injection are alarmist and my clients can rest easy in the knowledge that I have thoroughly investigated this issue.

But I understand your point that with all this heat there should be some fire. Trouble is all I can see is smoke and mirrors. I'm still waiting for a real world example.