Re: Strange beaviour in sql injection

["Kevin Spett" <kspett () spidynamics com>]

I think Dennis's explanation of the situation is probably accurate as far as
what's happening.

>  So, can we desume that the previous dogmas for securing a web application
>  replacing quotes and checking if a value is numeric are not enough?

Yes, the best way to protect against SQL injection is to program using
stored procedures, commands objects (in the case of ADO) and prepared
statements (for JDBC).  More info coming, stay tuned.



Kevin Spett
SPI Labs
http://www.spidynamics.com/