SQL injections in Access

[cornall]

Hi All,

I am tasked with looking after an application with an Access Backend. I want to ensure the site is protected from SQL injections during login.

I have added a replace to get rid of any ' by escaping them to ''.

Is there an equivelent of bind variables in access?

in JAVA I would use a prepared statement



PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS WHERE USERNAME=? AND PASSWORD=?");
prep.setString(1, username);
prep.setString(2, password);


Is there an equivelent of this in VBA and VBScript or is doing my replace enough?

Hope this makes sense!

D

[cornall]

Solved:

Used the command object to pass parameters



sQuery = "select * from table where a=? and b=?"

'run query
Dim objCommand
Set objCommand = Server.CreateObject("ADODB.Command")
objCommand.ActiveConnection = oConn
objCommand.CommandText = sQuery
objCommand.Parameters(0).value = sUsername
objCommand.Parameters(1).value = sPassword
Set oRS = objCommand.Execute()
Set objCommand = Nothing


Silly me for some reason I thought the command object wouldn't work with access!!!!