SQL Injection

[carranz]

I have been looking into SQL Injection. I have found a few things on the web.

But I am having difficulty on how it works or how you check to see if your vulnerable.

I have a login page with two textboxes and a command button.
username and password is input and the button is clicked.

How can I check to see for sql injection valnerability

 

[gmmastros]

Take a look at this.

http://uk.youtube.com/watch?v=MJNJjh4jORY

-George

"the screen with the little boxes in the window." - Moron

 

[damber]

post a link to your website and we'll tell you

A smile is worth a thousand kind words. So smile, it's easy!

 

[Tarwn]

Couple easy questions:

Are you building your SQL statements inline?
[Do you build your SQL strings in ASP and then execute or open the string, concatenating in variables that were posted]

Are you replacing single quotes in any posted values with two single quotes before adding them to your SQL string?
[sql = "SELECT * FROM MyTable WHERE MyField = '" & Replace(Request.Form("test"),"'","''")]

In the event that a value is supposed to be numeric, are you verifying that it is a number before concatenating it to your SQL string?
[i.e., values that your adding without quotes around them]

If the answer to the first question is yes and the answer to the second or third question is yes, then you have SQL Injection vulnerabilities.

--

Most people would suggest using Stored Procedures and Parameters and such to be truly secure. My preference is definitely to use Stored Procedures (for completely different reasons) but not every "database" has the ability. Here are the rules I follow to make my queries safe:

1) Everything from the user gets verified. I don't go any farther until I have verified that every input I get from the user (even hidden ones) have what I am expecting. This means IsNumeric checks on supposed number fields, IsDate checks on date fields, length checks on strings, etc.

2) Strings get escaped, replacing single quotes with two single quotes

3) Errors are captured. You can have a perfectly safe SQL Injection-proof site, but if someone spoofs an insertion form and puts 500 characters in a field that is only expecting 20, an error is going to occur. And that error will generally outline critical informaiton about your system (like the fact that you using an Access DB and here is where to find it).


Best MS KB Ever:

http://support.microsoft.com/kb/555375