Re: ISA Server and SQL Injection

["Bogdan Tomchuk" <bogdan.tomchuk () polytechnique fr>]

Protection against this kind of injection is just other way of patching the
code, so useless, because this assume knowing difference between "good" and
"bad" URL, so for OWA, for example, you define list of templates for all
known "good" URL and anything else will be consider as SQL injection. I do
not understand why to spend money on expensive firewall staff if you can
patch or upgrade software.



Keep your software current is always better then "imaginable" security given
by software level firewall especially against SQL injection.



> > Problem is the same: By seeing URL you have no
> > reliable way to say which parameter will be used in SQL query and how
> > (with/without transformation). Only application knew it.
> Yes sure, if you code application using in parameter some SQL query, you
> should read "howto do secure code for webapp"....
> Application mainly use value after used by the application inside a
> query, but the query is in the code.
>
> http://www.toto.com/test.php?product_id=4 is ok and there is NO WAY to
> see here some SQL Syntax.
http://www.toto.com/test.php?product_id=SELECT%20*%20FROM%20product%20WHERE
> %20id=4 is not ok, and you shoud fire developper doing this....