Link to home
Start Free TrialLog in
Avatar of calypsoworld
calypsoworldFlag for Portugal

asked on

XSS and SQL Injection attacks

Hi!

I'm developing a website ASP.net with SQL Server.

When I have to check the user's input?

Only in query forms?
Both in query and registration (insert) forms?

It's a good approach add a validator against XSS in every single textbox that receives user's input?
What about validators to check against SQL Injection? May I (or should I) use them? Or just let the native protection of DataSet to this work?

Thanks in advance!
ASKER CERTIFIED SOLUTION
Avatar of bureshd
bureshd

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of calypsoworld

ASKER

Ok, thank you for replies!

What about XSS (Cross Site Scripting).
May I (or should I) have a validator in every textbox with a regular expression

(&#|[^<>#&])*

to avoid < > $ #

?

XSS is about embbeded HTML or script , right? It makes sense to check the "user registration from" against XSS? I mean, the data will be stored on db and will not be necessarily shown on page.

Thank you!
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Ok.

So, parameterized strings allows a text that contains a XSS attack string because it does not affect the DB. The problem is if the string will be shown on a page. Right?

XSS attack and SQL injection are two very distinct vulnerabilities, right?

Thank you!
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you!