Mass SQL Injection Attack Hits Sites Running IIS

blog.sucuri.net

12 pointssucuri23 comments

SQL injection is platform independent. It usually targets a specific vendor's DB, but it's crappy code by users of the DB that is at fault.

So it's really SQL injection attack hits sites running crappy custom code.

Neither SQL server nor IIS are at fault here.

Did anyone say it's not platform independent?

The article just states a couple of IIS sites got compromised again. It's not blaming IIS for that.

And SQL injection is not completely platform independent: your database must support SQL for it to work.

it's more a problem with the APIs for talking to the vendor's DB. the easiest way to add user input to a DB query should be the right one. minimally, a DB query should not be trivially the same type as user input.

Reply on news.ycombinator.com