Let's say two programmers are working on a website for a store. They've created a small database for an online store. Users would have to register and provide a username(e-mail address) password,home address, and have the option to store the credit card information on their account. Obviously, you don't want attackers to get any of this information. Assume one of the programmers was careless and didn't filter SQL statements and didn't take proper measures to ensure malicious code wouldn't be accepted. The programmer that is working on the database, what can he do it ensure that, even if an attacker was able to enter SQL statements into the form and gain access to the database, it would be encrypted? What type of encryption is this case, would work best?
According to this SQL Server doesn't use salting when encrypting.
What I'm looking for is, if a user entered the correct username/password he would gain access to his own account, but should an attacker use SQL injection, he would get an encrypted database that he must attack in order to get the information.
Note: The programmers are using SQL Sever 2012