Preventing SQL Injection attacks: the differences between mySql and SQL Server 2008

Is there any reason to migrate from MySql to SQL server 开发者_如何学运维2008 if one's main concern is the blocking of SQL injection attacks?

Does Linq2Sql or EF provide additional protection?

---

No. The strategies for blocking against SQL Injection Attacks are similar (parameterized queries rather than dynamically built, stored procedures, checking parameters for malicious values, etc.).

And yes, since you're not writing any SQL code with EF or Linq To Sql, you could consider that an additional layer of protection.

---

Most of the work you can do to protect your system against sql injection is outside the database so that's not enough reason to change the DB engine.

You may want to take a look to WPL library from Microsoft.

The Microsoft Web Protection Library (WPL) is a set of .NET assemblies which will help you protect your web sites, current, future and past. The WPL includes

AntiXSS
AntiXSS provides a myriad of encoding functions for user input, including HTML, HTML attributes, XML, CSS and JavaScript.

• White Lists: AntiXSS differs from the standard .NET framework encoding by using a white list approach. All characters not on the white list will be encoded using the correct rules for the encoding type. Whilst this comes at a performance cost AntiXSS has been written with performance in mind.
• Secure Globalization: The web is a global market place, and cross-site scripting is a global issue. An attack can be coded anywhere, and Anti-XSS now protects against XSS attacks coded in dozens of languages.

Security Runtime Engine
The Security Runtime Engine (SRE) provides a wrapper around your existing web sites, ensuring that common attack vectors to not make it to your application. Protection is provided as standard for

• Cross Site Scripting
• SQL Injection

---

if you use store procedures in SQL Server it's more difficult to have a sql injection error.