XSS - SQL Injection -- Owasp vs AntiXss Vs Microsoft Anti-Cross Site Scripting Library

Question

Hello,

• We are looking at using a library to help us detect SQL injections.

• We are using sprocs and parametrized statements, but for the sake of this post that we are only using some sore of library that detects/ verifies user input.

Whats the best one? Easiest to implement? Easiest to update/manage? Why prefer one over the other?

On a side note:

I've just started using Owasp. with C#. I was hoping that there would be more default rules while validating. When using the isValid function, there are only 5 default rules.

CREDIT_CARD -- Rule name key for the credit card validation rule. DATE -- Rule name key for the date validation rule. DOUBLE -- Rule name key for the double validation rule. INTEGER -- Rule name key for the integer validation rule. PRINTABLE -- Rule name key for the printable validation rule.

I was hoping that there would be more default rules for string SQL Injection Detection.

Thanks

Answer 1

Using stored procs is a pretty big step in the right direction. What I’d add to that is input validation which it looks like you’re trying to do with the OWASP ESAPI library but it pretty simple to implement by regex in most cases. You should find plenty of publicly available patterns for most untrusted data.

The other thing you might want to do is to apply the principle of least privilege at your data layer. Consider using more than one SQL account and restricting the access of your account(s) used by publicly facing users to the absolute bare minimum functions. You’re using stored procs; try and avoid any datareader or datareader rights if you haven’t already.

More info in OWASP Top 10 for .NET developers part 1: Injection

Answer 2

I'm using AntiXSS for validating user input - specifically including protection aganist SQL Injection. I've seen a few attacks but nothings gotten through - so seems to work well for me.

Also - Troy knows what he's talking about - His article on the subject is a really good one :)