How to Detect, Identify and Defend against SQL Injection?

How to Detect, Identify and Defend against SQL Injection?
SQL Injection has been around for many years :) and you probably get over 3 million results when you googled the term. so why is it so HOT now? Well, not so long ago some folks (don't ask me who!!, go read) were claiming that it was an IIS exploit, etc. Hence, all IIS web servers are subjected to this exploit, but the fact is that it has nothing to do with IIS, it is Web application related, so if you have a web/database application that running on Apache or even IBM Websphere, etc, you are subjected to the attack as well when user inputs are not properly validated. In short, the attack uses these input as the command window/line to issue specify command to the database that "not suppose" to happen via the application interface. For example, user can easily manipulate the database scheme and data, or user can even gain further access via the database system to the actual operating system level access.
Anyway, Microsoft just released a security advisory on how to detect via a free scanner from HP, how to protect at IIS level via URLSCAN 3.0 :) take note that this is still beta and how to identify it at coding level via Microsoft Source Code Analyzer for SQL Injection, take note this analyzer only works for ASP.
While the above is useful and helpful, you probably want to educate your developers on secure coding by implementing proper input validation before the input is process by the web or database system. The advisory contains a lot more information about the attack technique, best practices and more. So make sure you forward the details to your developers!!!