Restrict semicolon to prevent SQL injection?

No it does not prevent sql injection attacks. Any time you're dynamically constructing SQL either in the client side, or with the EXEC inside a stored proc, you are at risk Parameterized queries are the preferred way to get your input into query.

No it does not prevent sql injection attacks. Any time you're dynamically constructing SQL either in the client side, or with the EXEC inside a stored proc, you are at risk. Parameterized queries are the preferred way to get your input into query.

Use parameterized queries (or stored procedures) and avoid dynamic SQL like the plague. I suggest using built in library functions instead of trying to write your own anti-injection code. A naive implementation will strip out ; even if it should be used (say as part of a passed in VARCHAR or CHAR parameter, where it is legal).

You will end up having to write your own SQL parser in order to accept/reject queries. You can read here more about dynamic SQL and the problems it presents (and solves).

No, it doesn’t. You just showed one example of an SQL injection. But there are far more, all depending on the context you insert the data into.

Besided that, it’s not the semicolon that causes this issue but the ' that ends the string declaration prematurely. Encode your input data properly to prevent SQL injection.

The best way to avoid SQL injection is to avoid string concatenation of user supplied data. This is best accomplished by either using stored procedures or using parameterized queries.

It will depend on a variety of things (which queries, etc). You should use prepared statements for this.

No, don't focus on semicolons. Focus on the way you put user input in the sql query - usually in quotes - and then focus on the quotes. Also don't forget when you work with regexp in sql that they need slightly different escaping procedure.

I cant really gove you an answer,but what I can give you is a way to a solution, that is you have to find the anglde that you relate to or peaks your interest. A good paper is one that people get drawn into because it reaches them ln some way.As for me WW11 to me, I think of the holocaust and the effect it had on the survivors, their families and those who stood by and did nothing until it was too late.