Solved

asp2mysql preventing code injections

Posted on 2008-06-17
7
184 Views
Last Modified: 2010-03-19
normaly when i insert users text into varchar\text field the system will
show me an error if the user typed " or '...

so, how can i let enable those + prevent from hackers to inject some queries and codes...

?
10q
0
Comment
Question by:Forrest_Gump
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 82

Accepted Solution

by:
hielo earned 200 total points
ID: 21806833
>>show me an error if the user typed " or '...
You need to escape the apostrophes with back-to-back apostphes.
Assuming you have:
firstname=Replace(Request("firstname"),"'","''")
lastname=Replace(Request("lastname"),"'","''")
strSQL = "INSERT INTO users(firstname,lastname) VALUES('" & firstname & "','" & lastname & "' )"

 As for the double quotes, you shoud be enclosing the values of your fields with apostrophes, NOT double quotes.
So, it should NOT be:
...values("John","Smith")

it should be
...values('John','Smith')

and the previous step about replacing the apostrophes with back-to-back apostrophes should avoid an invalid statement.
0
 

Author Comment

by:Forrest_Gump
ID: 21807121
so what you say is that i need to do Replace(Request("lastname"),"'","''")
to every one of my fields?
0
 
LVL 82

Expert Comment

by:hielo
ID: 21807139
>>...to every one of my fields?
Yes, For every field that you intend to put INTO a db.
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 29

Assisted Solution

by:rdivilbiss
rdivilbiss earned 150 total points
ID: 21809276
Actually there is a much better way.  Using prepared statements will prevent most SQL injections and allow you to ignore the issue of escaping quotes.

This also means when you return data from the database you also do not need to worry about un-escaping quotes.

Take a look at the attached link:

http://www.rodsdot.com/ee/parameterized_sql_multi_parameter.asp

You'll need to tweak a little for mySQL.
0
 
LVL 12

Assisted Solution

by:R_Harrison
R_Harrison earned 150 total points
ID: 21812763
Using two single quote, as Hielo suggest will only insert 1 single quote into the database, which is as per the user inputted and in my personal experience is the best way to go.

It should also be pointed out that SQL works equally well if you use numbers, in fact it is much easier to do SQL Injection if the page is expecting numbers as you do not usually have to escape the string.  Therefore if you are using numeric values in any SQL query then always check the value is actually numeric - don't assume it is just because that is what you are expecting...

e.g
if isNumeric(yourvariable)=false then -- do not run the SQL query as it could contain injection code --

0
 
LVL 29

Assisted Solution

by:rdivilbiss
rdivilbiss earned 150 total points
ID: 21813673
User input validation often fails victim to encoding attacks.

Using prepared statement or parameterized SQL is the strongest protection at little cost.

0
 
LVL 29

Expert Comment

by:rdivilbiss
ID: 21837962
Thanks for the assist and good luck on your project.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article was originally published on Monitis Blog, you can check it here . Today it’s fairly well known that high-performing websites and applications bring in more visitors, higher SEO, and ultimately more sales. By the same token, downtime…
CTAs encourage people to do something specific to show interest in your company, product or service. Keep reading to learn why CTAs should always be thought of as extremely important, albeit small, sections of websites.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question