Besides parameterizing SQL or using Stored Procedures, is there any
reliable way to test if a string has an SQL Injection attack. ...For
example, can one use the same method ADO uses when examining
parameters to detect SQL Injection?

Re: SQL Injection detection by Cowboy

Cowboy
Wed Mar 12 12:50:31 CDT 2008

You can run regex, but you have to be careful that the things you are
looking for. Generally things like:

' or userName is not null --

You can find the patterns, but what if the pattern is legal in a string? You
then throw out things that are valid. Better to parameterize.

--
Gregory A. Beamer
MVP, MCP: +I, SE, SD, DBA

*************************************************
| Think outside the box!
|
*************************************************
"GMartin" <glenn.e.martin@gmail.com> wrote in message
news:61423ca3-e4e0-4b15-9f5e-ef619cb2e0a2@b1g2000hsg.googlegroups.com...
> Besides parameterizing SQL or using Stored Procedures, is there any
> reliable way to test if a string has an SQL Injection attack. ...For
> example, can one use the same method ADO uses when examining
> parameters to detect SQL Injection?