Solved

Replacing Single Quotes - Still SQL Injection Issue?

Posted on 2009-07-09
8
2,022 Views
Last Modified: 2013-11-16
I have a quick question about SQL Injections... I want to know if replacing single quotes with extra single quotes is enough to prevent SQL Injections from QueryString-based database calls.

For example: http://www.mywebsite.com/viewPage.asp?id=1
Assume the following on the backend:
<%
dim id, rs
id = request("id")
id = replace(id, "'", "''")
set rs = getResults(id)
...
%>

Is this secure enough to prevent malicious attacks?
0
Comment
Question by:Unionblitz
8 Comments
 
LVL 14

Expert Comment

by:shru_0409
ID: 24814036
0
 
LVL 75

Expert Comment

by:Aneesh Retnakaran
ID: 24814313
Hello Unionblitz,
Avoiding the use of dynamic sql prevents them, if you want to have dynamic sql, use parameterised dynamic sql


Regards,

Aneesh
0
 

Author Comment

by:Unionblitz
ID: 24814864
I'm familiar with stored procedures and parameterized SQL (PHP, etc).  I just couldn't find a way to break the replace(SQL, [single quote], [single quote][single quote]).  shru 0409 provided a link that kind of went over a way to break it (I haven't tried it yet though).

Request from site: http://mysite.com/main.asp?id=1\'; DROP Table Users; --

Server Code in main.asp:
id = request("id")
id = replace(id, "'", "''")
sql = "select * from users where id = '" & id & "';"

Apparently, that would bypass the single quote guard.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 4

Expert Comment

by:TurboBorland
ID: 24818263
Yes, backslash (escape the next character) and the use of the char() function would break that security feature.  Blacklists are not the way to go.  Seeing as you are expecting an integer, force the query to be an integer.
0
 

Author Comment

by:Unionblitz
ID: 24819113
Thanks, TurboBorland... Could you please provide me with an example of the char() concept?  

Right now, I am talking strictly on Classic ASP/.NET and SQL Server.  I don't care about the insecurities of PHP and MySQL at the moment. I need a good reason to explain to my boss that replacing single quotes is not enough.
0
 
LVL 4

Expert Comment

by:TurboBorland
ID: 24819637
Sure, let's take the example of a UNION SELECT injection being made.  Also assume that we know the table names from grabbing from INFORMATION_SCHEMA.TABLES and INFORMATION_SCHEMA.COLUMNS.
      id=1/**/UNION/**/SELECT/**/TOP/**/1/**/password/**/FROM/**/admin_table/**/where/**/login_name=char(0x556e696f6e626c69747a)--    The name inside of char() is your name, hex encoded.  It conveniently bypasses the need to use quotes.  Now, the char() function would be useful to add to your query, while the backslash would be the easiest to end your current query and execute another one (like you're example of 1\'; next query;--.
0
 
LVL 4

Accepted Solution

by:
TurboBorland earned 50 total points
ID: 24819641
Sorry, that was MySQL.  Here's MS-SQL:  CHAR(85)+CHAR(110)+CHAR(105)+CHAR(111)+CHAR(110)+CHAR(98)+CHAR(108)+CHAR(105)+CHAR(116)+CHAR(122)
0
 

Author Comment

by:Unionblitz
ID: 24869966
TurboBorland, could you provide me with a practical example for the MS-SQL code you provided?  Perhaps for C# and ASP.NET or classic asp?
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
These days, all we hear about hacktivists took down so and so websites and retrieved thousands of user’s data. One of the techniques to get unauthorized access to database is by performing SQL injection. This article is quite lengthy which gives bas…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question