A recent study of hacker forums shows SQL injection is gaining favor as an attack vector. The company Imperva conducted a study of hacker forum discussions and concluded "SQL injection is now tied with DDoS as the most discussed topic."
Last year, the company said, DDoS was the most discussed attack vector, at 22 percent of discussion volume, while SQL injection followed at 19 percent. This year, both came in at 19 percent, indicating a relative rise in the popularity of SQL injection.
You have to take your studies and statistics with a grain of salt, though, as cloud hosting company Firehost reported at about the same time that SQL injection attacks accounted for only 12 percent of Web attacks blocked by its servers in the third quarter of 2012, with cross-site scripting attacks coming in first at 35 percent.
Regardless, SQL injection continues to be a serious problem that should get more attention from security teams and developers. For the latter, remember that Microsoft has some good resources to help you minimize security weaknesses, including:
There's lots more information out there. Most of the SQL injection attacks result from weaknesses in user input validation, which shouldn't be that hard to do properly. Hopefully these studies will continue to raise awareness among the coders writing these validations.
Share your thoughts on how to protect against SQL injection attacks by commenting here or dropping me a line.
Posted by David Ramel on 11/16/2012 at 1:15 PM
With Visual Studio v17.6 becoming generally available recently, Microsoft provided a peek at what's coming up in the next iteration, VS 2022 v17.7
Dev team shows how Welcome revamp was first presented and then how it was shaped by community feedback.
Microsoft's regular monthly update to Java on Visual Studio Code (May 2023) brings new features around performance improvement, the user experience and Spring Boot integration, among many others.
Dr. James McCaffrey of Microsoft Research says the main advantage of using Gaussian naive Bayes classification compared to other techniques like decision trees or neural networks is that you don't have to fine tune model parameters.
> More Webcasts