I'm a web applications developer, using Classic ASP as server side script.
I always protect my apps from SQL injection by using a simple function to double single apostrophe for string parameters.
Function ForSQL(strString)
ForSQL = Replace(strString, "'", "''")
End Function
For numeric parameters, I use the CInt, CLng and CDbl functions.
I often write concatenated query; I don't always use stored procedure and I don't always validate user inputs.
I'd like to ask you if someone can show me a working attack against this line of code:
strSQL = "SELECT Id FROM tUsers WHERE Username='" & _
ForSQL(Left(Request.Form("Username"),20)) & "' AND Password='" & _
ForSQL(Left(Request.Form("Username"),20)) & "'"
It could be a banality but I've never found a kind of attack that works.
I've always found "sqli helper 2.7" (you can download it) to find most/all SQL injections. I'm not sure if this will help at all, but it will at least help test for all of the SQL comments and everything. I remember on one of my sites it found a main SQL injection to dumb all of my database data. It's not exactly what you're looking for, but it might be able to find a way through.
There is no functioning SQL injection for input sanitized this way. The downside is retrieving data from the database is you have to replace on double apostrophes.
sDataRetrievedFromDatabase = Replace(sDataRetrievedFromDatabase, "''", "'")
Related
When using a prepared statement with Classic ASP such as this:
SQL = "SELECT user_name, user_sign_up_date FROM tbl_users WHERE this = ? AND id = ? "
Set stmt01 = Server.CreateObject("ADODB.Command")
stmt01.ActiveConnection = oConn
stmt01.Prepared = true
stmt01.commandtext = SQL
stmt01.Parameters.Append stmt01.CreateParameter("#x1", adVarChar, adParamInput, 255, card_pwd)
stmt01.Parameters.Append stmt01.CreateParameter("#x2", adInteger, adParamInput, , this_id)
set myRS = stmt01.Execute
Apart from doing the usual sense checking to e.g. make sure that a number is a number and so on, does the process of using this kind of Parameterised Statement mean that I no longer have to worry about, e.g. for a varchar or text field, sanitising the data input from users - e.g. would I no longer need to use a function to push everything input by a user through Server.HTMLencode?
I'm not sure if the parameterised statement route means I can be less strict re. sanitizing user data now?
You are conflating two different types of sanitisation. SQL parameterization prevents the “Bobby Tables” vulnerability — a maliciously written bit of data that tricks SQL into ending the current query and executing a separate query of the attacker’s choosing.
https://bobby-tables.com
Even with SQL parameters, an attacker could try to run a script on your page by (for example) entering “alert(‘Gotcha!’)” in a field. Display the field data on an HTML page and that script is written out and executed. To prevent that you use Server.HTMLencode
If your concern is SQL injection attacks then parameterization should remove the possibility of the SQL string being tampered with because the values are supplied at execution time.
Others are correct that you don't need to worry about the contents of the parameters. You do have to worry about the length of strings. I would pass Left(card_pwd, 255) to CreateParameter() to avoid exceptions crashing your script. I tend to not worry about calling IsNumeric() on integer parameters but that might be worthwhile (try passing nonsense and see what happens).
I've inherited a large amount of Classic ASP code that is currently missing SQL injection protection, and I'm working on it. I've examined in detail the solutions offered here: Classic ASP SQL Injection Protection
On the database side, I have a Microsoft SQL server 2000 SP4
Unfortunately stored procedures are not an option.
After studying php's mysql_real_escape_string ( http://www.w3schools.com/php/func_mysql_real_escape_string.asp ) , I've replicated its functionality in ASP.
My question(s) are:
1) Does Microsoft SQL server 2000 have any other special characters that need to be escaped that are not present in MySQL ( \x00 , \n , \r , \ , ' , " , \x1a )
2) From an answer in Can I protect against SQL Injection by escaping single-quote and surrounding user input with single-quotes? I read "One way to launch an attack on the 'quote the argument' procedure is with string truncation. According to MSDN, in SQL Server 2000 SP4 (and SQL Server 2005 SP1), a too long string will be quietly truncated."
How can this be used for an attack (I really can't imagine such a scenario) and what would be the right way of protecting against it?
3) Are there any other issues I should be aware of? Any other way of injecting SQL?
Note: A 30-min internet search said that there are no libraries for classic ASP to protect against SQL injection. Is this so, or did I really fail at a basic task of searching?
The best option is to use parameterized queries. On how that is done, you must check out:
SQL Injection Mitigation: Using Parameterized Queries
In PHP also, the PDO (and prepared statements) allows developers to use parameterized queries to avoid sql injection.
Update
Yes you can specify parameters in WHERE clause and for that you can use ADODB.Command object like below example:
' other connection code
set objCommand = Server.CreateObject("ADODB.Command")
...
strSql = "SELECT name, info FROM [companies] WHERE name = ?" _
& "AND info = ?;"
...
objCommand.Parameters(0).value = strName
objCommand.Parameters(1).value = strInfo
...
For more information, see the article link that I have posted above or you may want to research a little more on the topic if you want.
I use two layers of defense:
create a 'cleanparameter' function, and every call that gets from querystring or form values, use it calling that function. The function at the very least should replace simple quotes, and also truncate the string to a value you pass. So, for example, if the field can't be longer than 100 chars, you would call it like x = cleanparameter(request.querystring("x"), 100). That's the first line of defense
Use parameterized queries to run SQL instructions
I have a question regarding VB.net and the use of rsData connections to an SQL database.
Basically we have a few inline pages that will display course information of courses that my institution runs. The code will connect to an SQL DB and pull through live data directly in the following format.
html += "<tr><td>" & rsData("M_Start") & "</td><td>" & rsData("WEEKS") & "</td><td>" & rsData("DAYSTIME") & "</td></tr>"
Now I was wondering if people would suggest pulling directly from an open DB connection or map the RsData results to strings? All data connections open and close after they have done their required portions and we have around 5 different procedures that occur within the page.
I'm worried that the code isn't as clean as it could be and would really like to tidy up this inherited nightmare. Also can people shed any best practice with inline code and the multiple data connections?
Thanks!
It's difficult to give you a full solution on how to clean-up the code without seeing it all. Better ways to display your data might be using a GridView or Repeater.
However, if you are going to build up the HTML in a String variable I'd suggest doing the portion you've posted like this:
Dim html As New Text.StringBuilder
html.Append(String.Format("<tr><td>{0}</td><td>{1}</td><td>{2}</td></tr>",
rsData("M_Start"),
rsData("WEEKS"),
rsData("DAYSTIME")))
It makes it more readable and a StringBuilder performs better than incrementing a String variable multiple times.
I'm not sure how you are dealing with repetition, but you could then do something like this (assuming rsData belongs to a DataTable):
Const htmlRowFormat As String = "<tr><td>{0}</td><td>{1}</td><td>{2}</td></tr>"
Dim html As New Text.StringBuilder
For Each dr As DataRow In rsDataTable.Rows
html.Append(String.Format(htmlRowFormat,
rsDataTable("M_Start"),
rsDataTable("WEEKS"),
rsDataTable("DAYSTIME")))
Next
To get your html: html.ToString
I am using visual basic as the coding language.
conSQL.Open()
Dim cmd As New SqlCommand("update Phd_Student set student_name = '" + studentnameTextBox.Text + "' where student_id = '" + studentidno.Text + "'", conSQL)
cmd.ExecuteNonQuery()
conSQL.Close()
This does not change the value of the record. I created a breakpoint at line 2 and found that the value of studentnameTextBox.Text in the query is the old value even though I changed the text of the textbox in the form.
Would appreciate any help.
This code isn't anywhere close to being secure. Validate any input information before you use it in a query and consider using stored procedures as well.
And we'll need more information about the page state when you're trying to do this.
Also, put this code in an exception block and in the Finally block put the SQL close command. If anything blows up you're going to want to make sure that the connection is still closed and Finally takes care of that.
I recently inherited a classic asp website with a ton of inline SQL insert statements that are vulnerable to SQL injection attacks.
These insert statements are executed via the ADO command object.
Will setting the ADO Command Object's Prepared property to true ensure that the query is parameterized before execution, thus mitigating the risk of SQL injection?
This Link should prove useful.
Classic ASP SQL Injection Protection
No, if you build a SQL string with values that you get directly from "outside", then a "prepared statement" will not help you.
a
sSQL = "SELECT * from mytable where mycolumn = '" + querystring("value") + "'"
is still asking for trouble.
The only way to solve this is by using parameters in your query.
You can also look at an asp classic open source project called 'Owasp stinger'. That not only helps with Sql injection, but header injection and lots of other security issues common to all web apps.
http://www.owasp.org/index.php/Classic_ASP_Security_Project
Here's another good link and example.
http://blogs.iis.net/nazim/archive/2008/04/28/filtering-sql-injection-from-classic-asp.aspx
In the past we just created a couple functions to handle any outside input for SQL injections and XSS. Then slowly we converted all the inline SQL to stored procedures.
What I would suggest you do is write a function to sanitize the user input, then run all the request variables through that. When I wrote mine I did stuff like:
escape single quotes,
remove ; and other special characters and
make sure that you couldn't -- (comment) out the end of the statement.
Most SQL injection would try something like ' or 1=1 or a='
so the SQL code would be :
SELECT * from mytable where mycolumn = '' or 1=1 or a=''
So escaping single quotes is the real big one you need to worry about.