Strange beaviour in sql injection

 Conducting a pentest on a web application i discovered something strange..
 the web application corretcly replaces single quote (') with double quote
 ('')
 correctly checked if the value isnumeric
 but inserting in the query url a value with , the application show error
 
 for example:
 
 http://www.webapplication.com/show.asp?id=1,1
 
 show the error
 
 So, can we desume that the previous dogmas for securing a web application
 replacing quotes and checking if a value is numeric are not enough?
 
 I'd like to know also what Kevin Spett thinks..
 
 thanks..
 
 Antonio Stano
 Securityinfos
 http://www.securityinfos.com
 
 
Received on Oct 29 2002