Dynamic SQL: Applications, Performance, and Security in Microsoft SQL Server

© Edward Pollack 2019

Edward PollackDynamic SQLhttps://doi.org/10.1007/978-1-4842-4318-3_2

2. Protecting Against SQL Injection

Edward Pollack¹ 

(1)

Albany, NY, USA

 

There are few SQL vulnerabilities as commonly exploited as SQL injection. This form of database attack has destroyed companies, ruined careers, and is a constant challenge for security officers. As database professionals, data is our greatest asset, and it is our responsibility to guard it above all else. SQL injection is not limited only to dynamic SQL, but is a technique that can be applied to many areas of SQL Server. Therefore, understanding and defending against it are among the most important priorities when considering SQL Server security.

What Is SQL Injection?

SQL injection is an ...