Search this site for "Sql Injection". A common source of sql injection attacks is user-input which is not validated and is then trustingly concatenated before being sent to the database.
For example, if your statement is this:
select col1, col2 from mytable where id =' + <some variable> + ' and xyz = abc
(where 'some variable' is user input just passed on to the SQL)
then the user can input 'xxx''; delete from mytable; --'
and what the database gets is:
select col1, col2 from mytable
where id ='xxx'; delete from mytable; --' and xyz = abc
causing havoc.
So the key issue here is: don't pass unvalidated, concatenated text to your database for it to execute.
You can achieve this in several ways:
- check the input for unwanted characters (difficult to cover
everthing)
- build your SQL as parameterized SQL i.e. binding user input to
parameters
- invoke stored procedures (I like them but they are not everyone's cup
of tea)
I'd go for parameterized SQL as the database driver will take care of binding everything the user inputs as a single value, whilst at the same time keeping your business logic out of the database.