Re: ASP/PHP SQL Injection

[pratiksha.doshi () niiconsulting com]

Hi David,

In case of SQL Injection, we need to look out for code where there is
database query is formed espescially dynamic SQL which takes the parameter
directly from the user and embeds in the query.

Recommendation for SQL is using pre-complied SQL query which automatically
binds the respective datatypes to parameters.

In case of XSS, we need to mostly look for variables which are going to be
displayed back to the user.

Recommendation Sanitize the inputs like meta characters such as <,>,/ etc.
by using in built functions like HTMLEncode methods.


Hope this helps

Thanks
Pratiksha
Penetration Testing,CEH

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------