I appologize if this doesnt belong here, I didnt know where else to place it and I am a bit desperate.
I am trying to solve some issues with my websites that are allowing SQL injections.
I am new here and am hoping someone can help me. I have been fighting off these attacks over and over for months with the help of a .NET developer friend of mine. Everytime we think we have it we get hit again.
I am using .ASP and .ASP.NET with MsSQL Server2000.
I have multiple sites getting hit, we have changed everything to stored procedures.
I have been told I should be using parameters instead of what I have below, but I am unsure how to format properly. I know just enough about Stored Procedures to be dangerous. The way I am calling them below is the only way I know.
Lets start with an example from my simplest of .ASP sites since my .NET developer isnt here to help me with my .NET sites..
On this first page (auctions_ ...
Go to the complete details ...