full-disclosure - Antitoxin for "SQL Injection" (?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060102155213.GA8810@dvb>
Date: Mon Jan  2 15:53:55 2006
From: devdas at dvb.homelinux.org (Devdas Bhagat)
Subject: Antitoxin for "SQL Injection" (?)

On 02/01/06 13:45 +0100, Sen, Adem wrote:
> Hi @all!
> 
> I have invested some time to think about detecting & preventing SQL
> Injection attacks to web-applications.
> Like many of us know, there are several methods to filter dangerous
> input in web-applications, e.g. searching for specific RegEx Pattern and
> so on.
> 
> I have built following (primitive) RegEx Pattern to filter input to my
> private used web-apps:
> 
> RegEx Start
> /SELECT|INSERT|UPDATE|ALTER|CREATE|DELETE|DROP|FROM|WHERE|OR|AND|LIKE|EX
> EC|SP_|XP_|SQL|ROWSET|OPEN|BEGIN|END|DECLARE|;|--|-|'|\(|\)|=|>|<|@/i";
> /RegEx End
> 
Ugh! Why do you not use stored procedures and bind parameters, which is
the right way to do it?

Devdas Bhagat