WebApp Sec mailing list archives
RE: SQL injection (no single quotes used)
From: "Mutallip Ablimit" <mutax () insi co jp>
Date: Wed, 15 Dec 2004 19:25:23 +0900
Hi JC Quite interesting. But I couldn't get it work. It works fine on query analyser, but it didn't work when I try it on the application side (on the browser). (I used %0d%0a for the newline character) May be it depends on the version of MSSQL or the service pack etc. Could you tell us the version of the MSSQL on your side. Thanks, --- Mutallip Ablimit <mutax () insi co jp> -----Original Message----- From: Juan Carlos Calderon [mailto:johnccr () yahoo com] Sent: Friday, December 10, 2004 12:53 AM To: webappsec () securityfocus com Subject: SQL injection (no single quotes used) Hi all While in Oracle escaping apostrophe (') character seems to be enough protection for Sql Injection (I think is not), this is not true for Sql Server. Here a little example I think many of you will find useful. For an on-the-fly query like: Query = "select field1, field2... from table where id = '" + FixSQL (FieldValue) + "'" Where FixSQL will escape single quotes AKA apostrophe, the following value for "FieldValue" will be effective: FieldValue = "(NewLine)GO(NewLine)Desired Sql Sentence(NewLine)GO" Final result is: select field1, field2... from table where id = ' GO Desired Sql Sentence GO ' Here the MS Documentation for GO Keyword: <snip> SQL Server utilities interpret GO as a signal that they should send the current batch of Transact-SQL statements to SQL Server. The current batch of statements is composed of all statements entered since the last GO, or since the start of the ad hoc session or script if this is the first GO </snip> So one sentence become three, sentences one and three will fail, but sentence two (the one of our interest) will execute successfully. Hope you find this interesting Cheers, -JC _________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com
Current thread:
- Re: PHP Easter Eggs, (continued)
- Re: PHP Easter Eggs q q (Nov 29)
- Re: Fwd: PHP Easter Eggs Saqib . N . Ali (Nov 30)
- Re: Fwd: PHP Easter Eggs exon (Nov 30)
- Re: PHP Easter Eggs Paul Fierro (Dec 01)
- Re: PHP Easter Eggs Jimi Thompson (Dec 02)
- Re: PHP Easter Eggs Griffiths, Ian (Dec 03)
- SQL injection (no single quotes used) Juan Carlos Calderon (Dec 14)
- Re: SQL injection (no single quotes used) Olivier G. Gaumond (Dec 15)
- Re: SQL injection (no single quotes used) Juan Carlos (Dec 15)
- RE: SQL injection (no single quotes used) Brett Moore (Dec 16)
- Re: Fwd: PHP Easter Eggs exon (Nov 30)
- RE: SQL injection (no single quotes used) Mutallip Ablimit (Dec 15)
- Re: SQL injection (no single quotes used) PD9 Software (Dec 16)
- Re: SQL injection (no single quotes used) Adam Tuliper (Dec 15)
- Re: PHP Easter Eggs Devin Egan (Nov 29)
- Re: PHP Easter Eggs Rick Crelia (Dec 08)
- Re: PHP Easter Eggs James Barkley (Dec 14)