Database Encryption -- Sql Injection

Does any one have any comments on where best to incorporate Column level encryption in a Database field? At the Database Server level (via a User Defined Function) or at the Application Level. Which would be less impervious to SQL Injection?

I am on a MS-SQL 2000 and IIS Platform.

If I had a User Defined Function for example:  Select decrypt(AccountNumber, "key") from tblTable where User =
'someuser'

If SQL Injection occurs:
 Select decrypt(AccountNumber, "key") from tblTable where User =
'someuser' or 1=1

In this case if SQL injection occurs the encrypted field will be automatically decrypted by the UDF... Showing all accountNumbers...

If I had the Decryption handled at the Application:  Select encryptedAccountNumber from tblTable where User = 'someuser'

And had the application call:
 AccountNumber = DecryptFunction (ResultSet ("encryptedAccountNumber" ), "key")

If SQL Injection occurs, the only way data could be seen if through whatever mechanism the application displays the AccountNumber

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

(Are these scenarios identical ?)

I know that encryption is not a substitution for good input sanity validation.
Which method would be better to implement? Thanks for comments.

Regards,
Dave Bergert Received on Mon Apr 21 21:58:15 2003