Más SQL Injection

[Myakire]

Iniciado por Al Zuwaga

... pero me gustaría una respuesta tipo SI/NO a mi anterior pregunta

(Si ya eliminamos la posibilidad de que coloquen una comilla simple reemplazando ésta por dos de ellas seguidas... ¿igualmente pueden hacerte un SQL Inyection ...?)

(y mucho mejor si viene acompañada con algún artículo, que reitero, nunca encontré ninguno)

Pues parecese que SI.

There are two basic approaches to validation: disallow troublesome characters or only allow a small number of required characters. While you can easily disallow a few troublesome characters, such as the hyphen and single quote, this approach is less than optimal for two reasons: first, you might miss a character that is useful to hackers, and second, there is often more than one way to represent a bad character. For example, a hacker may be able to escape a single quote so that your validation code misses it and passes the escaped quote to the database, which treats it the same as a normal single quote character. A better approach is to identify the allowable characters and allow only those characters. This approach requires more work but ensures a much tighter control on input and is more safe. Regardless of which approach you take, you'll also want to limit the length of the entry because some hacks require a large number of characters.

http://msdn.microsoft.com/msdnmag/is...n/default.aspx

Saludos y nunca esta demás prevenir que lamentar