RE: SQL Injection and MSSQL

["Amichai Shulman" <shulman () imperva com>]

There are many evasion techniques. Some of them as you mentioned are
related to URL encoding and redundant UTF-8 representation. However
there are more advanced techniques that are derived from the SQL
language capabilities. I'd refer you to a WP we wrote on the subject
recently:
http://www.imperva.com/application_defense_center/white_papers/sql_injec
tion_signatures_evasion.html

-----Original Message-----
From: lipe! [mailto:lipe () brturbo com] 
Sent: Saturday, June 26, 2004 12:14 PM
To: webappsec () securityfocus com
Subject: SQL Injection and MSSQL


Hi all,

With filters like "if the parameter has substring 'SELECT'" a malicious
user can mask the 'select' from a request in ASP?

I mean something like (that i know witch works in MySQL)
"concat(char(1,2,3,4),char(5,6,7))"?

MS SQL Server has anyway to mascarade the querys, like some unicode
feature or string functions?

I just need to know if theres anyway that i can put a select in a query
without typing explicit "select". If there, why?

Many thanks!

------------------------------------------------------------
Felipe Santos Andrade <lipe () brturbo com>
Desenvolvedor TI/WEB Framework .NET
-----------------------------------------------------------