Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Antitoxin for "SQL Injection" (?)
From: Devdas Bhagat <devdas () dvb homelinux org>
Date: Mon, 2 Jan 2006 21:22:13 +0530

On 02/01/06 13:45 +0100, Sen, Adem wrote:
Hi @all!

I have invested some time to think about detecting & preventing SQL
Injection attacks to web-applications.
Like many of us know, there are several methods to filter dangerous
input in web-applications, e.g. searching for specific RegEx Pattern and
so on.

I have built following (primitive) RegEx Pattern to filter input to my
private used web-apps:

RegEx Start
/SELECT|INSERT|UPDATE|ALTER|CREATE|DELETE|DROP|FROM|WHERE|OR|AND|LIKE|EX
EC|SP_|XP_|SQL|ROWSET|OPEN|BEGIN|END|DECLARE|;|--|-|'|\(|\)|=|>|<|@/i";
/RegEx End

Ugh! Why do you not use stored procedures and bind parameters, which is
the right way to do it?

Devdas Bhagat
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]