Improving Web Application Security: Threats and - CGISecurity

640 Part V: Assessing Your SecurityData Access CodeThis section identifies the key review points that you should consider when youreview your data access code. For more information about the issues raised in thissection, see Chapter 14, “Building Secure Data Access.”●●●●●●●Do you prevent SQL injection?Do you use Windows authentication?Do you secure database connection strings?How do you restrict unauthorized code?How do you secure sensitive data in the database?Do you handle ADO .NET exceptions?Do you close database connections?Do You Prevent SQL Injection?Check that your code prevents SQL injection attacks by validating input, using leastprivileged accounts to connect to the database, and using parameterized storedprocedures or parameterized SQL commands. For more information, see “SQLInjection” earlier in this chapter.Do You Use Windows Authentication?By using Windows authentication, you do not pass credentials across the networkto the database server, and your connection strings do not contain user names andpasswords. Windows authentication connection strings either useTrusted_Connection=‘Yes’ or Integrated Security=‘SSPI’ as shown in the followingexamples."server='YourServer'; database='YourDatabase' Trusted_Connection='Yes'""server='YourServer'; database='YourDatabase' Integrated Security='SSPI'"Do You Secure Database Connection Strings?Review your code for the correct and secure use of database connection strings.These strings should not be hard coded or stored in plaintext in configuration files,particularly if the connection strings include user names and passwords.