Preventing SQL Injection Attacks

The following principles and implementations are adopted from Paul Litwin's article Stop SQL Injection Attacks Before They Stop You.

Principles:

• Never trust user input
• Never use dynamic SQL
• Never connect to a database using an admin-level account
• Don't store secrets in plain text
• Exceptions should divulge minimal information

The corresponding implementations are:

• Validate all textbox entries using validation controls, regular expressions, code, and so on
• Use parameterized SQL or stored procedures
• Use a limited access account to connect to the database
• Encrypt or hash passwords and other sensitive data; you should also encrypt connection strings
• Don't reveal too much information in error messages; use customErrors to display minimal information in the event of unhandled error; set debug to false