RE: SQL Injection

[<stevenr () mastek com>]

Hi 

The best way would be creating a white list, allowing only defined characters and rejecting everything else. Saves you 
headaches in the long run. Use Regexs for this.

This here is an interesting article 
http://www.aspectsecurity.com/article/bld_HTTP_req_val_engine.html

Regards,
Steven Rebello











-----Original Message-----
From: Serg B. [mailto:serg () dodo com au]
Sent: Tuesday, June 01, 2004 7:07 PM
To: emanuelez () libero it
Cc: webappsec () securityfocus com
Subject: Re: SQL Injection


Hi, 

Perhaps you could limit or anticipate charecter set used for users
username and passwords and filter out everything else?


On Fri, 2004-05-28 at 17:17, Emanuele Zattin wrote:
> Hello Everybody!
> I recently found out that one of my websites suffered SQL injections like > this:
>
> Login: a' OR 'a'='a
> Password: a' OR 'a'='a
>
> I solved the problem checking whether the logon or password variables 
> contained the "'" char... is it safe enough? i checked around the net and > found a recent paper from Imperva but it 
> does not talk about single chars 
> checking... i tried to ude different encodings but that string in UTF-8 is 
> just the same... any hint?
-- 
Serg B. <serg () dodo com au>



MASTEK
"Making a valuable difference"
Mastek in NASSCOM's 'India Top 20' Software Service Exporters List.
In the US, we're called MAJESCO

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Opinions expressed in this e-mail are those of the individual and not that of Mastek Limited, unless specifically 
indicated to that effect. Mastek Limited does not accept any responsibility or liability for it. This e-mail and 
attachments (if any) transmitted with it are confidential and/or privileged and solely for the use of the intended 
person or entity to which it is addressed. Any review, re-transmission, dissemination or other use of or taking of any 
action in reliance upon this information by persons or entities other than the intended recipient is prohibited. This 
e-mail and its attachments have been scanned for the presence of computer viruses. It is the responsibility of the 
recipient to run the virus check on e-mails and attachments before opening them. If you have received this e-mail in 
error, kindly delete this e-mail from all computers.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~