Ensure Database and Application User Input is Sanitized

보통레벨 1수동 검토mssql

설명

Always validate user input received from a database client or application by testing type, length, format, and range prior to transmitting it to the database server.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Check with the application teams to ensure any database interaction is through the use of stored procedures and not dynamic SQL. Revoke any INSERT, UPDATE, or DELETE privileges to users so that modifications to data must be done through stored procedures. Verify that there's no SQL query in the application code produced by string concatenation.

조치 방법

조치 방식: 가이드 또는 인프라 패치

The following steps can be taken to remediate SQL injection vulnerabilities: ; Review TSQL and application code for SQL Injection ; Only permit minimally privileged accounts to send user input to the server ; Minimize the risk of SQL injection attack by using parameterized commands and stored procedures ; Reject user input containing binary data, escape sequences, and comment characters ; Always validate user input and do not use it directly to build SQL statements

속성

운영 체제: 모두
태그: mssqldatabasemanual
참고 자료: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 6.1 Ensure Database and Application User Input is Sanitized