Knew Injection attacks were supposed to be easy, but THIS easy?!?!

it's gr8888888888888888888888888888888888888888888888888888

Parametrization of the sql queries is a popular way to reduce threat of sql injections. Sometimes RegEx functions are used along with it to fortify the defence.

Thanks.

However,it is my understanding that putting all input box text through

string.replace("'","''") will stop every type of sql attack on MS Sql server. This stops all attempts to terminate the quotes and input any extra commands.

If this is not the case, can anyone give me an example where it would not work? I would like to know if there are any examples, as this method is what I have used for years.

Can You Confirm this??

Rule of thumb: if your app has a "Tell me what my password is" function, then it needs to be rewritten as a "Reset forgotten password" - in a well written app, even the system administrator/DBA should not have access to clear text credentials.

Great job! Where is the Source Code?

There was one company that overlooked the SQL injection issue and all of the classic asp and asp.net automated database input code was open to vulnerabilities for many years until the application was finally patched. Microsoft IDE products are safe if you use these guidelines but I would be vary wary of auto-code generators. The SQL statements generated by these tools should be scrutinized with vigor.

I am not going to name any of these products but quick google search of "asp.net code generator" will provide a lengthy list. Please inspect and verify that your SQL statements are safe if you decide to use one of these products.

I myself have been caught off guard with one of these products a few years ago by not being diligent in regard to outputted code.

nice video. thanks a lot!

Good tips, thanks.

However,it is my understanding that putting all input box text through

string.replace("'","''") will stop every type of sql attack on MS Sql server. This stops all attempts to terminate the quotes and input any extra commands.

If this is not the case, can anyone give me an example where it would not work? I would like to know if there are any examples, as this method is what I have used for years.

----------

Yes, I have also used this method for years. If you are using Microsoft products for the front end also remove the escape character like this:

string.replace("\","")

I concur. I've been using the "replace" method since my first SQL development in the 90s. I'd like to say it is because I'm a security guru, but it's not. My first application required lookup by name and there are many names (O'Brien for example) that would error in my initial testing. When resolving that problem, the potential for this type of attack was readily apparent. I have always coded to text values and always used the replace function.... name matter the type of input. I also have each input restricted as to character length and, in some cases, numeric or alpha.

CC

Nice one its good enough.

hey Capedcoder,

Nice reply for replace problem.