The What, Why and How of Software Security

I assess software security for a living, but I almost missed this one. < connectionStrings > < add name = " Conn " connectionString = " server=server1; database=database1; Integrated Security=True " Encrypt = " True " /> </ connectionStrings Read More...

Most resources on the internet concentrate on dynamic SQL in the data access code as the cause of SQL injection. Although lesser known, SQL injection is also possible if the stored procedure itself constructs dynamic SQL and executes it with the “exec” Read More...