Improving Web Application Security: Threats and - CGISecurity

376 Part III: Building Secure Web ApplicationsInput ValidationAside from the business need to ensure that your databases maintain valid andconsistent data, you must validate data prior to submitting it to the database toprevent SQL injection. If your data access code receives its input from othercomponents inside the current trust boundary and you know the data has alreadybeen validated (for example, by an ASP.NET Web page or business component) thenyour data access code can omit extensive data validation. However, make sure youuse SQL parameters in your data access code. These parameters validate inputparameters for type and length. The next section discusses the use of SQLparameters.SQL InjectionSQL injection attacks can occur when your application uses input to constructdynamic SQL statements to access the database. SQL injection attacks can also occurif your code uses stored procedures that are passed strings which contain unfiltereduser input. SQL injection can result in attackers being able to execute commands inthe database using the application login. The issue is magnified if the applicationuses an overprivileged account to connect to the database.Note Conventional security measures, such as the use of SSL and IPSec, do not protect youagainst SQL injection attacks.Preventing SQL InjectionUse the following countermeasures to prevent SQL injection attacks:● Constrain input.●Use type safe SQL parameters.Constrain InputValidate input for type, length, format, and range. If you do not expect numericvalues, then do not accept them. Consider where the input comes from. If it is froma trusted source that you know has performed thorough input validation, you maychoose to omit data validation in your data access code. If the data is from anuntrusted source or for defense in depth, your data access methods and componentsshould validate input.