Re: SQL Injection Code Help

Sorry but I am a newbie. What do you mean by paramertize?

"Dan Guzman" wrote:

Note that you can parameterize SQL Statements even without procs. Perhaps a
phased implementation will get you there faster.

--
Hope this helps.

Dan Guzman
SQL Server MVP

"Jody" <Jody@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1F902517-1CEF-43E4-B669-C3DE2B1F116B@xxxxxxxxxxxxxxxx
Yes I believe that would be the way to go but there is a large learning
curve
here. My thinking was as a first line of defense was to limit the
permissible characters in all the fields of each of the forms first, then
work on stored procedures angle.

This is a very large site and I am just learning about it and best
practice,
not to mention learning to code. Therefore It feels more efficient to put
in
snippets of code in the forms first then hire a consultant to do the rest.
If you have some code example we could easily implement for each field
that
would be most appreciated.

Thanks - Jody

"Jody" wrote:

I have a client who needs help securing their website site from SQL
injection, which has already occurred. We have locked down the SQL
server
end of things pretty well but need to cleanup and secure the code. The
pages
are ASP pages are written in mostly HTML and Visual Basic Script.

What we need to learn how to do quickly (very newbie at this) is to set
all
form fields to only allow the following characters so no SQL instructions
will be accepted into any given form field

We want to only allow allow: abcdefghijklmnopqrstuvwzyz1234567890 @ . -
_

If an apostrophe is entered we want it to be converted to two apostrophes
with a space between them so ( ' ) would then be changed to ( ' ' ) and
any
double hyphens entered ( -- ) gets a space added between them ( - - ) or
some
other safe elimination of the double SQL hyphen.

The other (2nd priority item) would be to help us hide and/or password
protect the non-public db update forms.

Here is a sample of some of the form code on one of the forms if that
helps.
IF someone is willing to show us what the code is we need to insert to
accomplish this that would VERY appreciated.

<td align="left">*First Name Initial *Last Name<br
/><input type="text" name="bFname" id="bFname" size="21"
onKeyup="autotab(this, document.OD.bmI)" maxlength="30"
tabindex="1"><input
type="text" name="bmI" id="bmI" size="6" onKeyup="autotab(this,
document.OD.bLname)" maxlength="3" tabindex="2"><input type="text"
name="bLname" id="bLname" size="30" onKeyup="autotab(this,
document.OD.bStAddy1)" maxlength="30" tabindex="3"></td>



.

Relevant Pages

  • Re: UDF returns table to feed a call back to itself ... how? (cross post)
    ... be so sure that this is a newbie error. ... Pro SQL Server 2000 Database Design ... Was your first> language a procedural language? ...
    (microsoft.public.sqlserver.programming)
  • RE: Data Access
    ... Someone has already written some code to use reflection and custom attributes ... to dynamically build the required SQL. ... > execute the stored procedure. ... > when there are say 30 form fields that need to be inserted or updated. ...
    (microsoft.public.dotnet.general)
  • Re: Speed Effeciency on Form updates
    ... Once you hit a wall with SQL, you can start thinking about a VBA solution. ... If that gets too inefficient also, you will need to consider using a temporary table to store the partially massaged data for further processing. ... Tips for Access users - http://allenbrowne.com/tips.html ... results into the form fields or is it better to use controlsource property ...
    (microsoft.public.access.modulesdaovba)
  • Re: sql injection question
    ... "Dan Guzman" wrote: ... If ad-hoc SQL must be used, ... When stored procedures are used, ensure the command type stored procedure ... Grant execute permissions (to a database role) on only the stored ...
    (microsoft.public.sqlserver.security)
  • Re: SQL 2000 drops connection, DDOS attack?
    ... "Dan Guzman" wrote: ... network error', you might try using a different protocol. ... using the Client Network utility or specified in the connection string. ... SQL Server MVP ...
    (microsoft.public.sqlserver.security)