SQL Injection on the Rise

Microsoft released a new advisory today on the rising number of instances of SQL Injection that are happening on the web. 

To view the security advisory, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/advisory/954462.mspx

If you have web sites that concatenate unchecked user inputs or parameter line arguments into SQL database calls, then it is important that you fix this problem following the guidelines on this advisory.  This is not all to uncommon, nor is it overly surprising to see this more and more.  This is a common question on the forums, and more than a few posts have been dedicated to trying to help people look into these problems after being attacked.

Securing Production Servers from Developers with SSMS and Application Usernames/Passwords

This post has been migrated to my new blog on SQLBlog.com. You can find this post at the following address:

http://sqlblog.com/blogs/jonathan_kehayias/archive/2008/06/18/securing-production-servers-from-developers-with-ssms-and-application-usernames-passwords.aspx

SQL Server 2008 RC0 - Publicly Available

Today at TechEd 2008 in Orlando, Bob Muglia, Microsoft Vice President of Server and Tools, announced that SQL Server 2008 Release Candidate 0 (RC0) has been made available for public download. As previously announced, RC0 marks the final public release before SQL Server 2008 RTMs in Q3 of this year

• Download SQL Server 2008 RC0
• What's new in SQL Server 2008

SQL Error 10310

The Text for this error is:

AppDomain %i (%.*ls) is marked for unload due to common language runtime (CLR) or security data definition language (DDL)

But there is no reference for this in the BOL at all.  If anyone has a reference for this please email me.