Ensure Database and Application User Input is Sanitized

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Check with the application teams to ensure any database interaction is through the use of stored procedures and not dynamic SQL. Revoke any INSERT, UPDATE, or DELETE privileges to users so that modifications to data must be done through stored procedures. Verify that there's no SQL query in the application code produced by string concatenation.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

The following steps can be taken to remediate SQL injection vulnerabilities: ; Review TSQL and application code for SQL Injection ; Only permit minimally privileged accounts to send user input to the server ; Minimize the risk of SQL injection attack by using parameterized commands and stored procedures ; Reject user input containing binary data, escape sequences, and comment characters ; Always validate user input and do not use it directly to build SQL statements