RE: ASP/PHP SQL Injection

Hi there,
To eradicate sql attacks there are some solutions, the best one is to code
well ;), here are some tips for php and linux servers:

for php code;
a)limit the number of characters in the variables OR the valid characters
that there can be used.(A-Z,0-9, etc).
b)put addslasesh or magic_quotes
c)create users in db with different privileges and always use the ones that
you need in each moment.

For linux server:
Use mod_security with good filters

Use Scanners to detect vulnerabilities before you launch officially the
site.

This are just some tips, our friends here in the mailing list will have some
more.

Thanks
Daniel Gargallo [Spain]
http://www.daniel-gargallo.com

-----Mensaje original-----
De: coder [mailto:elite.coder@xxxxxxxxxxxx]
Enviado el: miércoles, 30 de agosto de 2006 0:20
Para: security-basics@xxxxxxxxxxxxxxxxx
Asunto: ASP/PHP SQL Injection

Hi all,

I have been reading quite a bit into SQL injections and I just wondered if
my thinking is correct:

If one has the ASP or PHP source code for a site, they would just look for-

(written in a pseudo-ish code as I assume the same principles exist for ASP
and PHP)

$variable = get_value_from_url('variable') // ie blah.asp?variable="hello"

SQL = "SOME SQL" & $variable & "SOME MORE SQL"
or
<executing object (i.e. rs.open)> "SOME SQL" & $variable & "SOME MORE SQL"

When looking for potential SQL Injection attacks, its one of the 2 SQL lines
one would look for... is that correct? And to stop SQL Injection attacks,
one only has to "sanitise" the variable with CLng() in the case of numeric
fields and in the case of alphanumeric fields a built-in PHP/ASP/MySQL
function can be used.

Also, assuming my thinking above is correct, what does one look for when
checking for possible XSS attack?

Thanks for your input,

Davie Elliott



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------





--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.405 / Virus Database: 268.11.6/428 - Release Date: 25/08/2006



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • Re: [PHP] SQL Readability.. (was Re: most powerful php editor)
    ... Subject: [PHP] SQL Readability.. ... Your switchon the gettypeof the value misses the type 'boolean' so it falls through the default: case which then appends whatever was left from the previous pass. ... >> SELECT blah, blah, blah, blah, blah, blah, blah, blah, blah ...
    (php.general)
  • RE: SQL Smuggling
    ... Its several methods for encoding sql queries or tricking multi layered input validation/sanitisation routines, none of which are new, all of which are implemented by every pen/app tester i have ever worked with. ... of SQL Injection that has not received attention till now. ... As for attacks against signature validation... ... SQL injection attacks against commonly broken data validation routines. ...
    (Bugtraq)
  • Re: Making groups
    ... It's actually the native array type in PHP. ... PHP is not SQL, Tcl is not SQL, C is not SQL, Python ... An ordered list is not a dict. ... Procedural and Object programmers can't ...
    (comp.lang.tcl)
  • RE: MS SQL, find list of tables
    ... connected to the Access ODBC driver. ... MS SQL, find list of tables ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • Re: SQL Server Password Cracker/Guesser
    ... >> Can anyone tell me what they are using to crack/guess SQL Server ... >> Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ... Cross site scripting and other web attacks before hackers ...
    (Pen-Test)