Re: SQL injection

[Hernán M. Racciatti <hracciatti () gmail com>]

On 6/10/05, Leandro Reox <lmet5on () fibertel com ar> wrote:

> Like Todd says "nothing is 100% secure"

Is the real life...

> so wellcoded web apps + good sigs
> based detections + good db diagramming + a lot of conscience makes a nice
> combo.

I agree, but I would add one or two additional items: security in
depth and less privileges...

p.d: In SQL Injection tactics, evasion OFTEN is possible ej:

'OR 1=1--
'OR1=1--
'or2>1--
%27%4f%52%20%31%3d%31%2d%2d
%27%4f%52%20'a'=N'a'
etc...

Config n signatures is theoretically possible, but not in practical terms...

Clean code is the only last defense.. 

My 2 cent.
Bye.

-- 
Hernán Marcelo Racciatti

Core Team Member ISECOM (Institute for Security and Open Methodologies)
Coordinator OISSG, Argentina (Open Information System Security Group)

[mailto:hracciatti () gmail com]
[http://www.hernanracciatti.com.ar]