I've been searching Google all day trying to find a difinitive answer to this question but one doesn't seem to exist.

 

I'm very new to development and, whilst I'm aware of some of the security vulnerabilities that affect dynamic websites, I'm struggling with implementing effective counter-measures.

 

I know I have to make sure my application is secure, but I can't find a set way of doing it - so my question is how do you secure your SQL queries in ASP? I've seen 2 key phrases a lot in my searches; parameterized queries and stored procedures. What I haven't managed to find is what the difference is, which should be used and why.

 

I've found a simple implementation of both and, whilst I can see the logic of the parameterized query - how it works - I can't say the same for the stored procedure.

 

I've got a deadline of the start of August to meet, I've got no idea how to implement these security measures and I've got to completely re-structure the layout of the system from tables to divs - I need as much help as I can get!

 

Cheers.

When I was forced to use classic ASP with MS Access a few years I ended up using the following:

 

(Emphasis mine). For those reading this who don't know, the reason he had to be forced to is likely because Access doesn't scale very well - it's incapable of dealing with more than 255 concurrent connections.

Well the system I'm building isn't particularly big, but does obviously still need to be secure. I'm currently using an Access database, but will be moving to an Oracle one soon. What will the implications of this be? If I were to learn a method of securing against SQLI now, would I need to change it once I've moved to Oracle?

 

I'm a total, total newbie when it comes to this so I'm sorry if any of my questions are ridiculous.

Generally, the advice you're getting here is more abstract stuff that applies to any RDBMS. I've never worked with Oracle so I couldn't possibly tell you any specifics there, but security stuff like this tends to apply across the board.

Right, OK, that's good. Trying to learn this is stressing me out enough as it is - if I managed to address the issue and then had to change it again after the database change, I would probably cry.

 

I've had a little look at that link and it looks very helpful - I've sent it to myself at work and will look at it tomorrow when I can actually do something with it.