Full Disclosure mailing list archives
Re: Antitoxin for "SQL Injection" (?)
From: Devdas Bhagat <devdas () dvb homelinux org>
Date: Mon, 2 Jan 2006 21:22:13 +0530
On 02/01/06 13:45 +0100, Sen, Adem wrote:
Hi @all! I have invested some time to think about detecting & preventing SQL Injection attacks to web-applications. Like many of us know, there are several methods to filter dangerous input in web-applications, e.g. searching for specific RegEx Pattern and so on. I have built following (primitive) RegEx Pattern to filter input to my private used web-apps: RegEx Start /SELECT|INSERT|UPDATE|ALTER|CREATE|DELETE|DROP|FROM|WHERE|OR|AND|LIKE|EX EC|SP_|XP_|SQL|ROWSET|OPEN|BEGIN|END|DECLARE|;|--|-|'|\(|\)|=|>|<|@/i"; /RegEx End
Ugh! Why do you not use stored procedures and bind parameters, which is the right way to do it? Devdas Bhagat _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Antitoxin for "SQL Injection" (?) Sen, Adem (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) Devdas Bhagat (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) Vulnerability Management (Jan 02)
- <Possible follow-ups>
- RE: Antitoxin for "SQL Injection" (?) Sen, Adem (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) James Tucker (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) Jan Muenther (Jan 03)
- Re: Antitoxin for "SQL Injection" (?) Marco Ermini (Jan 03)