SQL Server 2008 Administration in Action

6.6. SQL injection protection

A SQL injection attack exposes unintended data to an application user by taking advantage of poor or missing application input parsing. As an example, consider the following code:

var city;
city = request.form ("shippingCity");
var sql = "select * from orders where ShipCity = '" + city + "'";

The intention of this code is that the city variable will be populated with something like Prague. However, what would happen if the following value was entered in the shippingCity form field?

Prague'; select * from creditCards--

The semicolon character marks the end of one command. The rest of the input will run as a separate query, and by adding the comments (--) characters to the end of the input, we ensure any code added ...