I've got a situation where I need to use LINQ's ExecuteCommand method to run an insert. Something like (simplified for purposes of this question): object[] oParams = { Guid.NewGuid(), rec.WebMethodID }; TransLogDataContext.ExecuteCommand ( "INSERT INTO dbo.Transaction_Log (ID, WebMethodID) VALUES ({0}, {1})", oParams); The question ...
Does WebSphere offer an HTTP input filter / firewall like mod_security? I know that it's possible to have Apache be the HTTP server front-end to WebSphere, but that type of configuration is beyond my influence. We're stuck using just what WebSphere itself can do. EDIT - To clarify, I am not looking for authentication, authorization, o...
I am new to web programming and have been exploring issues related to web security. I have a form where the user can post two types of data - lets call them "safe" and "unsafe" (from the point of view of sql). Most places recommend storing both parts of the data in database after sanitizing the "unsafe" part (to make it "safe"). I am ...
What automated tools are there? ~~ Mark Harrison ~~ ...
I have code like this: var newMsg = new Msg { Var1 = var1, Var2 = var2 }; using (AppDataContext appDataContext = new AppDataContext(ConnectionString)) { appDataContext.CClass.InsertOnSubmit(newMsg); appDataContext.SubmitChanges(); } After reading this post I believe that the same logic applies. Does anyone think that...
I have a public facing website that has been receiving a number of SQL injection attacks over the last few weeks. I exclusively use parameterised stored procedures so I believe that there has been no successful attacks, but a recent log showed an interesting technique: Line breaks added for clarity http://www.mydummysite.uk/mypage.as...
Hi. I'm creating a site where the user unfortunately has to provide a regex to be used in a MySQL WHERE clause. And of course I have to validate the user input to prevent SQL injection. The site is made in PHP, and I use the following regex to check my regex: /^([^\\\\\']|\\\.)*$/ This is double-escaped because of PHP's way of handling...
Taking over some code from my predecessor and I found a query that uses the Like operator: SELECT * FROM suppliers WHERE supplier_name like '%'+name+%'; Trying to avoid SQL Injection problem and parameterize this but I am not quite sure how this would be accomplished. Any suggestions ? note, I need a solution for classic ADO.NET - I d...
Lets say on MySQL database (if it matters). ...
We've just been given the following code as a solution for a complicated search query in a new application provided by offshore developers. I'm skeptical of the use of dynamic SQL because I could close the SQL statement using '; and then excute a nasty that will be performed on the database! Any ideas on how to fix the injection attack?...
When reading about SQL Injection and XSS i was wondering if you guys have a single string that could be used to identify those vulnerabilities and others. A string that could be thrown into a website database to black box check if that field is safe or not. (going to do a large test on a few inhouse tools) Rough example, wondering if y...
Parameterized Queries in .Net always look like this in the examples: SqlCommand comm = new SqlCommand("SELECT * FROM Products WHERE Category_ID=@categoryid", conn); comm.Parameters.Add("@categoryid", SqlDbType.Int); comm.Parameters["@categoryid"].Value = CategoryID; But I'm running into a brick wall trying to do the following: Sql...
I need to avoid being vulnerable to SQL injection in my ASP.NET application. How might I accomplish this? ...
I've been preaching both to my colleagues and here on SO about the goodness of using parameters in SQL queries, especially in .NET applications. I've even gone so far as to promise them as giving immunity against SQL injection attacks. But I'm starting to wonder if this really is true. Are there any known SQL injection attacks that will...
My company has a requirement that all production sites pass an AppScan security scan. Sometimes, when we scan a SharePoint installation, the software detects a blind SQL injection vulnerability. I'm pretty sure this is a false positive--AppScan is probably interpreting some other activity in the HTTP response as success of the blind inje...
In a comment on a previous question, someone said that the following sql statement opens me up to sql injection: select ss.*, se.name as engine, ss.last_run_at + interval ss.refresh_frequency day as next_run_at, se.logo_name from searches ss join search_engines se on ss.engine_id = se.id where ss.user_id='.$user_id.' group by...
Just looking at: What does this SQL do: Robert'); DROP TABLE STUDENTS; -- I know both ' and -- are for comments, but doesn't the word DROP get commented as well since it is part of the same line? ...
I'm doing this system Stacked and I am creating the search function. And in that process it occurs to me that maybe AR/nHibernate Expression.Like (and siblings) might maybe not be 100% "safe" in that you can create stuff like; "\r\ndrop database xxx;---" and similar things...? I would expect them to be safe, but I am not sure... ...
I run all my integers through a (int)Integer to make them safe to use in my query strings. I also run my strings through this function code if(!get_magic_quotes_gpc()) { $string = mysql_real_escape_string($string); } $pattern = array("\\'", "\\\"", "\\\\", "\\0"); $replace = array("", "", "", ""); if(pr...
Anyone know a good lib where i can run the strings before they are inserted, that can strip out sql/javascript code? To be run in jsp pages. Idealy the lib would be: Free Lightweight Easy to use Thanks in advance to the SO community who will happily reply :) ...