Security Basics: Re: about SQL injection

[David MacDonald <davidpmacdonald () gmail com>]

The vulnerability lies in your html/asp/jsp/cgi page and not the
database.  Filter out single quotes, double quotes, keywords like or
and select from your query before it hits your database.  A person who
can perform the injection can potentially retrieve a lot of
information, that is if the usernames and passwords in your database
are used elsewhere in your network/system.  Do a google search on
filtering sql injection.

Dave

On Apr 3, 2005 10:07 AM, Seung Hyun Cho <s970501 () gmail com> wrote:
> Hi,
>
> I am running my site on IIS & MS-SQL.
>
> I've found vulnerabilities in some pages.
> exploited query is working like...
> "select * from xxx where id=3"
> when I put something like '2 or 1=1', it shows every data in xxx.
>
> But... is it kind of big vulnerability?
> What hacker can do to my site in this situation?
>
> Thanks,
>
> ---------------------------------------------------------------------------
> Earn your MS in Information Security ONLINE
> Organizations worldwide are in need of highly qualified information security
> professionals.  Norwich University is fulfilling this demand with its MS in
> Information Security offered online.  Recognized by the NSA as an
> academically excellent program, NU offers you the opportunity to earn your
> degree without disrupting your home or work life.
>
> http://www.msia.norwich.edu/secfocus_en
> ----------------------------------------------------------------------------
---------------------------------------------------------------------------
Earn your MS in Information Security ONLINE
Organizations worldwide are in need of highly qualified information security 
professionals.  Norwich University is fulfilling this demand with its MS in 
Information Security offered online.  Recognized by the NSA as an 
academically excellent program, NU offers you the opportunity to earn your 
degree without disrupting your home or work life.

http://www.msia.norwich.edu/secfocus_en
----------------------------------------------------------------------------