More on the recent rash of SQL injection attacks (update 6/3)

Fellow MVP Steve Kass and Microsoft's Buck Woody have some links and advice about preventing SQL injection attacks not only from affecting your data but also from affecting your users.  You can see the information here:

http://stevekass.com/blog/2008/05/31/read-this-if-you-serve-up-web-pages-from-sql-data/

And here:

http://blogs.msdn.com/buckwoody/archive/2008/05/30/sql-injection-attacks.aspx

I agree with Steve wholeheartedly here.  Having your data compromised is one thing... you learn from it, you fix it, you move on.  But aiding in the distribution of whatever payload is in all of these <script> files that you are unwittingly unleashing on your viewers is something you should try to avoid at all costs.  Unless you are storing your actual HTML content and layout in the database (which is usually a no-no), there is no reason you should ever blindly throw data from the database into a web page without first making sure that all HTML tags (like <BR>) are replaced with characters that make them non-rendering (like &lt;BR&gt;).

Another excellent resource is the following article:

http://blogs.technet.com/swi/archive/2008/05/29/sql-injection-attack.aspx