Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Security & SQL Server

[kmkeen71]

Hi WHT Clan,

I have a question for the forum and am looking for advice.

My former partner is haveing serious hacking problems and this is impacting her software development. She is using SQL Servedr and she is attributing all of the problems to SQL. She says the more she reads up on it the more she realizes how easy it would be to hack into any SQL server that has input text boxes without validation.

My argument is that, yes it does have security issues (what Microsoft product doesn't) but is it really that easy. How secure is it? Should I stay away from it?

Alternate solutions?

Thanks & Best Regards,
Kyle

[Steven]

Depends on how its getting hacked, it could be getting hacked through weak logins such as sa/null. There is also a "sql hello" exploit for mssql.

[mattwade]

Originally posted by kmkeen71
She says the more she reads up on it the more she realizes how easy it would be to hack into any SQL server that has input text boxes without validation.

I think that can apply to just about any sql server. If data is not validated, SQL injection attacks can and will happen.

[freebird]

Re: Security & SQL Server

quote:
--------------------------------------------------------------------------------
Originally posted by kmkeen71
She says the more she reads up on it the more she realizes how easy it would be to hack into any SQL server that has input text boxes without validation.

--------------------------------------------------------------------------------
I think that can apply to just about any sql server. If data is not validated, SQL injection attacks can and will happen.
--------------------------------------------------------------------------------

I second that. Its the responsibility of the programmer to validate any data entered into forms.

Depending on the complexity of your application, you can probably rewrite your application using asp.net rather rapidly using well know tools such as dreamweaver or ms visual studio. The code produce by these tools take care of the validation. But thats just for asp.net, not classic asp.