More on SQL injection
Posted by hackthisway on November 12, 2009
In SQL databases,
anything following the quote ( ‘ ) is considered code. So, If we want to check if a website is vulnerable to SQL injection, we just need to type a single quote in the URL. The website may vomit an error saying argument is invalid SQL result resource or there is an error in your SQL syntax etc… This would prove the website is SQL injectable.
Besides the quote character, other characters can also be used to check SQL injection. Like, In case of Oracle, blank space, comma or double quote characters.
Preventing SQL injection
To protect against SQL injection, user input must not directly be embedded in SQL statements. Instead, parameterized statements must be used (preferred), or user input must be carefully escaped or filtered.
Source: wikipedia
How To: Protect From SQL Injection in ASP.NET
http://msdn.microsoft.com/en-us/library/ms998271.aspx
protect mysql db :
http://digg.com/linux_unix/How_To_Protect_MySQL_Database_From_SQL_Injection_Attacks
protect Oracle db:
http://www.securityfocus.com/infocus/1646
