I recently posted about 500,000 sites having been subjected to SQL injection attacks. For the most part, these were old ASP sites. Frankly, I didn't realize there were that many ASP sites still in existence, let alone badly coded! However, both PHP and ASP.NET sites were attacked also. Let's be clear about this: we are talking about bad coding practices here and not about any specific security flaw per-se.

Apparently the saga continues; although I don't have exact figures, there was another rise in attacks in May. Suffice to say that Microsoft saw fit to release a security advisory (954462) on Tuesday, 06-24-2008. Microsoft also enlisted the help of HP to develop a free scanner, called Scrawlr, which can identify whether sites are susceptible to SQL injection. Microsoft also announced the availability of a SQL Injection tool; a static code analysis tool to help find SQL injection vulnerabilities in older Active Server Pages (ASP) code.

 * Microsoft Source Code Analyzer for SQL Injection Tool
 * Microsoft Security Advisory (954462)

You can find plenty of informative links on good coding practices by visiting these two sites, so I'm not going to repeat them here. There is no need for somebody to have a site that is this vulnerable. It's not about spending more money upgrading your version of ASP.NET; it's about employing responsible programmers. The tools mentioned here are basically stopgap measures to buy some time before implementing a more robust solution. What price your data?