Microsoft SDL (Security Development Lifecycle) team released recently two guidance papers:
The SQL Injection subject is not at all new. As an example 9 years passed since NGSSoftware published their
SQL Server Injection Whitepapers.
What brings new the SDL Quick Security Reference on SQL Injection? Among other things it describes the role in addressing this issue for the business decision maker, the architect, the developer, and tester.
The following graphic based on data published by
breach.com shows the importance of SQL Injection as a threat:
