Ensure Database and Application User Input is Sanitized

中等級 1人工審核mssql

說明

Always validate user input received from a database client or application by testing type, length, format, and range prior to transmitting it to the database server.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Check with the application teams to ensure any database interaction is through the use of stored procedures and not dynamic SQL. Revoke any INSERT, UPDATE, or DELETE privileges to users so that modifications to data must be done through stored procedures. Verify that there's no SQL query in the application code produced by string concatenation.

修補方式

修補方法: 操作指南或基礎設施修補檔

The following steps can be taken to remediate SQL injection vulnerabilities: ; Review TSQL and application code for SQL Injection ; Only permit minimally privileged accounts to send user input to the server ; Minimize the risk of SQL injection attack by using parameterized commands and stored procedures ; Reject user input containing binary data, escape sequences, and comment characters ; Always validate user input and do not use it directly to build SQL statements

屬性

作業系統: 不限
標籤: mssqldatabasemanual
參考資料: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 6.1 Ensure Database and Application User Input is Sanitized