Home page logo
/

basics logo Security Basics mailing list archives

RE: Test for SQL Injection
From: "Rui Pereira (WCG)" <wavefront1 () shaw ca>
Date: Thu, 6 Nov 2008 10:59:55 -0800

Scrawlr is free.

Thank You
 
Rui Pereira,B.Sc.(Hons),CIPS ISP,CISSP,CISA,CWNA,CPTS/CPTE
Principal Consultant
WaveFront Consulting Group
 
wavefront1 () shaw ca | www.wavefrontcg.com | 1 604 961 0701
 

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Michael Condon
Sent: November 6, 2008 9:23 AM
To: David Crandell; security-basics () securityfocus com
Subject: Re: Test for SQL Injection

I imagine that HP Scrawlr is a bit pricey.
If JavaScript is required to enable the Submit button on an HTML form, is 
there a way to circumvent this?
I do have two layers of server side protection from SQL Injection as well.
----- Original Message ----- 
From: "David Crandell" <david () onholdwizard com>
To: "'Michael Condon'" <admin () singulartechnologysolutions com>; 
<security-basics () securityfocus com>
Sent: Monday, October 27, 2008 10:37 AM
Subject: RE: Test for SQL Injection


I have used HP's scrawlr.

To prevent attacks, validate input in your forms (server-side, not just 
with
javascript) and make sure any querystring parameters are filtered or
validated with server-side code before they are passed to the database.

Dave Crandell
Vice President, Information Systems
On Hold Media Group
972-758-1300
david () onholdwizard com

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] 
On
Behalf Of Michael Condon
Sent: Sunday, October 26, 2008 1:59 PM
To: security-basics () securityfocus com
Subject: Test for SQL Injection

What are some open source utilities I can use to test a web page for SQL
Injection vulnerability (MySQL), and what coding practices can be
implemented to prevent the exploit?





No virus found in this incoming message.
Checked by AVG - http://www.avg.com 
Version: 8.0.175 / Virus Database: 270.9.0/1770 - Release Date: 11/5/2008
5:36 PM


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]