Protection from SQL Injection

re: Protection from SQL Injection

bholyfield — Tue, 02 Sep 2008 06:09:05 GMT

URLScan is a great defense mechanism for web server attacks, but I have found that it is not flexible enough to defend against web application-level attacks like SQL Injection. The group I work with just released a free module for IIS (called SPF) that provides a flexible mechanism for blocking malicious requests. It provides coverage options for Query Strings, POST data and Cookies (where as URL Scan is limited to just Query Strings). It also supports use of regular expressions to define malicious input sequences.

SPF for IIS is available for free and can be downloaded from our website: www.gdssecurity.com/.../tools

You can also find out more about it from the following Blog post: www.gdssecurity.com/.../iis-secure-parameter-filter-spf-released

re: Protection from SQL Injection

Anonymous — Mon, 01 Sep 2008 07:24:21 GMT

Thanks guys. Very helpful.

re: Protection from SQL Injection

Anonymous — Sat, 30 Aug 2008 23:55:47 GMT

If a site is written correctly SQL injection should not be an issue at all. The basic steps that should be taken include...

1. Always use parameterised Queries or Stored Procedures.

2. The SQL login used by the scripts in the site should only have access to do what is required and nothing more. For example if the site user only requires access to limited sub-set of stored procedures, ensure that these stored procedures are all it can access.

All the user input validation in the world cannot fully protect against SQL injection. However if you religiously follow these 2 basic basic principals it will.

Basically the only reason SQL injection works, is because sites dynamically create arbitrary SQL using hard coded strings combined with user entered data and pass. The problem here is that there's always the possibility that the user entered data can contain SQL commands.

If instead you use parameterised queries then the user entered data is only ever treated as data, never SQL commands, so basically it can contain whatever it likes and it wont be harmful.