Security problem

[Micke Palm]

Hi there!

When I went to work today I found that someone have create a table in the
database and insert the names of all other tables in a field in this table.
We have config a account in the database as we use from web.config so I
suppose the user have done something in the site like typing a smart sql
string in a textbox or similar.

Do anyone any ideas of securitys in the site to set so this situation will
be zip? Or any other ideas how the user can do something like this??

/regards, micke

 

[Arun Ganesh [.NET MVP]]

Hi,

Check the link for solution.

http://msdn.microsoft.com/library/default.asp?
url=/library/en-us/dnnetsec/html/SecNetch12.asp

warm regards,
Arun .
www.arunmicrosystems.netfirms.com

 

[Micke Palm]

Thanks a lot!

/micke

Hi,

Check the link for solution.

http://msdn.microsoft.com/library/default.asp?
url=/library/en-us/dnnetsec/html/SecNetch12.asp

warm regards,
Arun .
www.arunmicrosystems.netfirms.com