malicious input

[Cullen411]

I created a form that lets visitors input text. Unfortunately it is being abused.
So I used myvar=server.htmlencode("Request.form("textarea"))
and then inserted it into the database.
However I thought this would have stopped malicious input though someone was able to insert html tags including the marquee tag.
Can anyone let me know how I can stop this and even how they were able to get round the server.htmlencode?

thanks.

 

[guitardave78]

It is possible they are using a sql injection.
If you do not protect against that they can do prety much anything. Look it up there is loads of info.

The function i use to kill this method of attack is

function killChars(strWords)

dim badChars
dim newChars

badChars = array("select", "drop", ";", "--", "insert","delete", "xp_")
newChars = strWords

for i = 0 to uBound(badChars)
newChars = replace(newChars, badChars(i), "")
next

killChars = replace(newChars,"'","''")

end function

%>

}...the bane of my life!

http://www.fuzzyd.co.uk

 

[guitardave78]

you could try the htmlencode on the response.write(server.htmlencode(myvar))
Or even find a function that will strip out all html tags

Function stripHTML(strHTML)
'Strips the HTML tags from strHTML
'replace <br> with newline
strHTML = replace(strHTML,"<br>",vbnewline)
strHTML = replace(strHTML,"<br />",vbnewline)
strHTML = replace(strHTML,"<BR>",vbnewline)
strHTML = replace(strHTML,"<BR />",vbnewline)
  Dim objRegExp, strOutput
  Set objRegExp = New Regexp

  objRegExp.IgnoreCase = True
  objRegExp.Global = True
  objRegExp.Pattern = "<(.|\n)+?>"

  'Replace all HTML tag matches with the empty string
  strOutput = objRegExp.Replace(strHTML, "")
  
  'Replace all < and > with &lt; and &gt;
  strOutput = Replace(strOutput, "<", "&lt;")
  strOutput = Replace(strOutput, ">", "&gt;")
  
  stripHTML = strOutput    'Return the value of strOutput

  Set objRegExp = Nothing
End Function

}...the bane of my life!

http://www.fuzzyd.co.uk

 

[ksbigfoot]

One condition that messed up one of my queries is when the user put in 1=1. I now check for that.

 

[Cullen411]

ok thanks guys.