Detect SQL Injection

Question

I came to a company that already has a fully grown project... but coders that worked here before me didn\'t follow conventions and didn\'t use parametrized SQL queries... as

Answer 1

I applaud your willingness to dive in and fix things, and not just shrug and say, "ehh.. no one will attack our site anyway".

I think that perhaps the best approach would be to sanitize the inputs, assuming they are innocent, across the board. The problem is, there could be legitimate reasons for someone to enter any of the characters that could trigger SQL Injection.

Just trying to detect such patterns would be subject to false positive 'attack' results; Maybe someone tries to search for john's car, not knowing at all that the single-quote could be 'bad'. And maybe they really do need to search for that. Or, what have you...