Deleting stuff from MS Access db from an entry

steinooo · 23 Jan 2006 at 15:04

Hi all,

I wondered if anyone knew if it was possible to delete entries in an MS Access database table from just entering data into it?

I shall explain :

If you have a web form (in asp.net for example) where you can enter details into the Access DB like "firstname", and "biography" etc, is it possible to enter a certain string in this web form which could delete entries in that table?

Many thanks.

steinooo · 23 Jan 2006 at 15:15

roboffer - thanks, but why the bout of silence? Is it because it's "1337 h4xx0r" material?

steinooo · 23 Jan 2006 at 15:19

OK, well to cut a long story short, I need make provisions to secure a database against such methods

() so you advise just searching the net for enforcing stronger permissions etc

steinooo · 23 Jan 2006 at 15:29

roboffer said:
eg If you are always returning data by specifying an id, cast the input striaght away.

What do you mean by this sorry?

steinooo · 23 Jan 2006 at 16:51

sfx said:
I am not saying it is not possible but it is very unlikely that it will happen to him. Avaoiding SQl Injection is easy as long as you keep your code tight. Even better, use Stored Procedures where possible with web applications.

sfx

That's what I was asking, how would I make my code "tight" in your opinion sfx?

steinooo · 23 Jan 2006 at 17:22

cheers, I dont' know enough about Stored Procedures in MS Access (yet) but I thought the following protected against SQL injection :

Dim queryString As String = "INSERT INTO [Members] ([username], [password], , [age], [firstname], [last"& _
"name], [biography], [admin], [logins]) VALUES (@username, @password, @email, @age, @firstn"& _
"ame, @lastname, @biography, @admin, 0)"[/quote]