If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

 
Go Back  dBforums > Data Access, Manipulation & Batch Languages > ASP > ADO & SQL injection

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 05-01-06, 10:20
blmgyossi blmgyossi is offline
Registered User
 
Join Date: May 2006
Location: New York
Posts: 15
ADO & SQL injection

Since search criteria for my website comes from the user, is there a (Classic) ADO method that tests for SQL injections?
Reply With Quote
  #2 (permalink)  
Old 05-01-06, 16:11
loquin loquin is offline
Super Moderator
 
Join Date: Jun 2004
Location: Arizona, USA
Posts: 1,797
Quote:
Originally Posted by blmgyossi
Since search criteria for my website comes from the user, is there a (Classic) ADO method that tests for SQL injections?
Since there's really no difference in the techniques used to test a database for security vulnerabilities and exploiting a database using security vulnerabilities, a public discussion of this topic is discouraged here.
__________________
Lou
使大吃一惊
"Lisa, in this house, we obey the laws of thermodynamics!" - Homer Simpson
"I have my standards. They may be low, but I have them!" - Bette Middler
"It's a book about a Spanish guy named Manual. You should read it." - Dilbert

Reply With Quote
  #3 (permalink)  
Old 05-01-06, 16:31
blmgyossi blmgyossi is offline
Registered User
 
Join Date: May 2006
Location: New York
Posts: 15
What I meant by method was, an ADO object method (function or sub).
Reply With Quote
  #4 (permalink)  
Old 05-02-06, 17:05
wayneph wayneph is offline
Registered User
 
Join Date: Aug 2005
Location: D/FW, Texas, USA
Posts: 78
no not directly. you have to do it as a developer. One way to help prevent SQL Injections is to use parameters instead of creating your SQL string on the fly.

Other than that some common things to do is replace a single quote with double quote, filter out things like '--' which is a comment in SQL Server, and ignore things like 'xp_' or 'sp_' which can be used to call system stored procedures.
Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On