From the course: SQL Server: Security for Developers

Unlock the full course today

Join today to access over 22,700 courses taught by industry experts or purchase this course individually.

Demo: Dynamic SQL parameterization

Demo: Dynamic SQL parameterization - SQL Server Tutorial

From the course: SQL Server: Security for Developers

Start my 1-month free trial

Demo: Dynamic SQL parameterization

“

- [Instructor] In this demo I wanted to show a few various typical SQL injection attacks. The first one's probably one of the more advanced ones, but we're going to declare V as Varchar 255 that's going to be our parameter. Somebody has passed in an attack or potentially has passed in this hex string that we see here on line four. In this simple example we're just going to go ahead and print that so we're going to see what would happen. And what that generates is sp_helpdb which is a system stored procedure, so on line seven we're going to go ahead and execute that. And what sp_helpdb does is gives us a list of all the databases on a given server. As you can imagine that might be something a hacker would be interested in. If we were executing this code arbitrarily what would happen was the user would get passed back this value in his return from whatever webpage you're using. That would help the attacker better understand the surface area of your server and dive deeper in with its…

Contents