How to solve the SQL injection problem

Question

Hello All Friends i am facing a problem of SQL injection.Please anybody send me the solution for how to solve that problem.Please Please Please Please send me the solution in Javascript because i developed the particular site using Javascript. not in dot net. Thanks & Regards Prashant S. More

Nathan Lane · Answer

A good way to avoid SQL injection problems is to use a tier-based architecture for your web site. For example secure all of your database transactions in explicitly managed functions and never allow SQL queries to be made in high level code. Place your query functions in a persistence or data tier that lies under a business object tier. Then use the business object tier to call the query functions using only the parameters that you need. You would probably do good to pick up a book on multi-tier web development in C# or even a generic one (non C# and non language-specific). You could also only allow your query functions to call stored procedures making it less possibly for SQL to be injected because SQL stored procedures only accept certain types of arguments. Just some ideas. Edit: I just read your post more thoroughly and noticed that you didn't use C# at all rather you're using JavaScript. You would still do good to get that book (make sure it is not language-specific so that it just goes over the theories and basics) and you could still write a multi-tier system using JavaScript I think. You'll just have to be more creative but you may still need to include some back end coding like PHP or ASP to get the right kind of SQL protection.

Ryan Alford · Answer

it really has nothing to do with the language. it's how you are interacting with the SQL database. use stored procedures and you shouldn't have a problem. Do NOT use inline queries with text from a textbox as a parameter.