Preventing SQL Query Exposure in Memory – Visual C++ Application

Question

Preventing SQL Query Exposure in Memory – Visual C++ Application

Mohammad Raza 0

A thick client application using Visual C++, and during a security audit, we found that SQL queries are stored in memory in plaintext. Using memory dump analysis tools, we were able to extract these queries, which raises security concerns.

We would like guidance on the following:

Are there recommended best practices in Visual C++ to prevent sensitive strings (such as SQL queries) from being stored in memory in plaintext?
Does the Visual C++ runtime provide any options to securely handle and clear memory after processing SQL queries?
Are there compiler or linker settings that can help mitigate this issue?

We appreciate any advice, security recommendations, or official documentation that could help us improve the security of our application.

1 answer

Your answer

Answer 1

Minxin Yu 13,011 Microsoft External Staff

Hi,

Validate All Input.

Using Parameterized Queries.

Using Stored Procedures.

Here is document:
SQL Injection

Best regards,

Minxin Yu

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Preventing SQL Query Exposure in Memory – Visual C++ Application

1 answer

Your answer