Preventing SQL Injection at the Database

This walkthrough covers exploiting second-order SQL injection in an Excel report export feature, chaining stored procedure UNC path injection via xp_dirtree to exfiltrate database details over DNS.

Open-sources NetSPI's SQL injection wiki, a consolidated knowledge base spanning detection through attack queries across DBMSs, covering data extraction, obfuscation, and pivoting past the DB.

SQL injection inside stored procedures using dynamic SQL can escalate to sysadmin when procedures run with elevated privileges via WITH EXECUTE AS or certificate signing, as this walkthrough shows.

Reacting to an editorial claiming coders who write SQL injectable code should be fired, the author argues blame extends to architects, DBAs, QA, and decision makers who won't fund real testing.

Secure database configurations are important. However, many database administrators fail to lock down accounts that are used by trusted services.

Database security that survives incidents: least-privilege roles per service, managed and rotated credentials, encryption with reviewed key access, contextual audit logs, and tested restore paths.