Re: malformed sql queries

[Francois Scala <fscala () ogilvy net>]

"Gabriel A. Maggiotti" wrote:
>         http://www.host.com/file?id=121%20into%20outfile%20'/tmp/file.txt'


The solution is, you must make a list of characters that you accept and
reject anything else.
And, you must decode/convert before filtering anything.

For this example, an "id" should contain only numbers or hexa chars.

"2114213" => good
"3244; drop table users" => bad, ";" not in the list

-- 
--=>[ Francois Scala / System & Network Administrator ]<=------------
--=>[ Phone: +33 1 40762339 / Fax: +33 1 40762425 ]<=----------------