My previous post on this topic generated so much discussion that I thought I should post about it some more. Specifically I wanted to write about means of checking your code for possible SQL Injection problems.
The first means of checking, if you are using Visual Studio 2008, is to use the Team System environment. Specifically, there is a code analysis rule in there that will check for some SQL issues.
Note: This set of rules is not a complete set of possible security rules, nor are the existing rules 100% guaranteed to find all the problems in their area of analysis. No code analysis tool can replace a formal security audit. Nevertheless, we have found inside Microsoft that this can be of great help finding potential security issues.
This is a very usefu ...
Go to the complete details ...