Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:




webappsec logo WebApp Sec mailing list archives

Web Forms filtered with SQL constraints
From: Bénoni MARTIN <Benoni.MARTIN () libertis ga>
Date: Tue, 5 Oct 2004 13:25:50 +0100

Hi list !

I was wondering how to solve the 2 following problems: I have ASP (not ASP.NET) formulaires people have to fill in. To 
avoid SQ injection attacks and other tricks, I have set up some Jscript filtering on each field (i.e. for instance a 
name can just be alphabet's characters and no figures :) ), and I am planning to do the same on my Database (setting up 
constraints).


But I have 2 questions:
        - How can I hide my Jscript filtering from the user ? When I want to see the source, everything is diaplayed, 
quite normal :( ... Maybe it's not so good to tell people what I have done to filter them :) I saw some sites where it 
is impossible to see the source, impossible to "hoover the site", impossible even to print ... But I have not been able 
to find on the net how to do this :(

        - How can I deal with possible SQL errors within an ASP page ? I mean, if a field has been filled in, bypass my 
Jscript filtering (no matter how), and gets to the database but is then "stopped" by an SQL onstraint, how do I raise 
this error on an ASP page without diplaying an explicit error (giving the user the name of my database for instance) ?

Cheers for any clue, I am lost on this topic :(


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]