?
Solved

Sql Injection script

Posted on 2011-09-15
2
Medium Priority
?
302 Views
Last Modified: 2012-05-12
Hi!
I have a sql injection script that i use and still i got som unwanted code in my database, why?

I got a link in the code, but i have replaced < and > in the script.
function funcValidering(strTextmin)
	txtNew = replace(strTextmin,"""","&quot;")
	txtNew = replace(txtNew,"&","&amp;")
    txtNew = replace(txtNew,"'","&#39;")
	txtNew = replace(txtNew, "<", "&lt;")
	txtNew = replace(txtNew, ">", "&gt;")
	txtNew = replace(txtNew, "--", "&#8208;&#8208;")
	txtNew = replace(txtNew, "+", "&#43;")
	txtNew = replace(txtNew, "/*", "")
    txtNew = replace(txtNew, "*/", "")
    txtNew = replace(txtNew, "\n", "")
    txtNew = replace(txtNew, "@@", "")
	funcValidering = txtNew
end function

Open in new window

0
Comment
Question by:MickeC
  • 2
2 Comments
 
LVL 31

Accepted Solution

by:
Wayne Barron earned 2000 total points
ID: 36548093
Here, give this a shot, this is what I use.

Function ProtectSQL(SQLString)
SQLString = SQLString
SQLString = Replace(SQLString, ">", "&gt;") ' replace > with &gt;
SQLString = Replace(SQLString, "<", "&lt;") ' replace < with &lt;
SQLString = Replace(SQLString, vblf,"<br />") ' replace vblf with <br /> (This is mainly used for Memo fields.
SQLString = Replace(SQLString, "(","&#40;") ' replace ( with &#40;
SQLString = Replace(SQLString, ")","&#41;") ' replace ) with &#41;
SQLString = Replace(SQLString, "&", "&amp;")
SQLString = Replace(SQLString, "@@", "")
SQLString = Replace(SQLString, "/", "&#x2F;")
SQLString = Replace(SQLString, "%", "&#37;")
SQLString = Trim(SQLString)
ProtectSQL = SQLString
End Function

Open in new window


Also, in your code, some of the words are different.


      txtNew = replace(strTextmin,"""","&quot;") ' strTextmin
      txtNew = replace(txtNew,"&","&amp;")       ' txtNew

Good Luck
Carrzkiss
0
 
LVL 31

Expert Comment

by:Wayne Barron
ID: 36548233
Glad I could help.
Carrzkiss
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I would like to start this tip/trick by saying Thank You, to all who said that this could not be done, as it forced me to make sure that it could be accomplished. :) To start, I want to make sure everyone understands the importance of utilizing p…
Have you ever needed to get an ASP script to wait for a while? I have, just to let something else happen. Or in my case, to allow other stuff to happen while I was murdering my MySQL database with an update. The Original Issue This was written…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Kernel Data Recovery is a renowned Data Recovery solution provider which offers wide range of softwares for both enterprise and home users with its cost-effective solutions. Let's have a quick overview of the journey and data recovery tools range he…
Suggested Courses

593 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question