avoiding SQL injection attacks

without the need to replace words

[Simon606]

Hi

I have a web 2.0 ASP website that relies on user input. How can I stop SQL injection attacks without the need to replace words like , Join, Select, Delete etc.

I have searched everywhere but cannot find an answer.

Please help

[mrMister]

You only need to replace the occurrences of apostrophes presented in user Data...

Dim strName As String = Request.from("name").replace("'","''")
Dim strSQL As String = "SELECT address FROM users WHERE name = '" & strName & "'"

However...

Ad Hoc SQL is nearly always a bad idea. Consider using parameterized SQL or stored procedures instead.

[Ocean10000]

These are the links I keep handy for reference for this vary question.

MSDN:How To: Protect From SQL Injection in ASP.NET [msdn2.microsoft.com]

MSDN:How To: Protect From Injection Attacks in ASP.NET [msdn2.microsoft.com]

MSDN:Anti-Cross Site Scripting [msdn2.microsoft.com]