Microsoft SQL Server 2008 R2 Unleashed- P44:SQL Server 2005 provided a number of significant new features and enhancements over what was available in SQL Server 2000. This is not too surprising considering there was a five-year gap between these major SQL Server 2008 is not as much of a quantum leap forward from SQL Server 2005 | 374 CHAPTER 13 Security and Compliance Enable the audit. USE master go ALTER SERVER AUDIT NEW_SQL_Server_Audit WITH STATE ON Test the audit is working USE AdventureWorks2008R2 GO SELECT from GO Disable the audit. USE master GO ALTER SERVER AUDIT NEW_SQL_Server_Audit WITH STATE OFF GO It is recommended that you create your audit specifications with scripts so that you can easily manage them and not have to re-create them via SSMS dialogs. SQL Injection Is Easy to Do As we previously stated SQL injection is the number-one security vulnerability globally as reported and tracked by the Open Web Application Security Project OWASP . org . Because of this continued vulnerability we decided to show you how to do SQL injection. However keep in mind that we are showing you how to do it so that you can prevent this situation from happening to you. You need to make sure you include the vulnerability checks as a part of your coding and design reviews. Then this will never happen to you. If you have a typical .NET forms application that prompts users to provide filter criteria to locate information this is often a perfect place for hackers to add their own malicious code to do damage. Even your own employees might be hackers or want to cause harm. We call these folks Evil SQL ers. The most common way SQL injection occurs is with the direct insertion of code into a variable that is part of a SQL statement. In other words a user-defined variable is concatenated with a partially defined SQL statement and then subsequently executed as part of the application. The hacker adds a terminating character to the first part of the input and then follows it up with his or her own destructive SQL statement. Let s consider the following simple Contact Name search application as an example. A .NET forms application might define a variable called ContactFirstName and then prompt the end user for a value to search for any contact s first name that begins with a .
