CODEWITHSUNDEEP
asp-classicsql-injection
Frank G.
Frank G.

Reputation: 1579

SQL Injection Is this Good

I have done quite a bit of research on this but I'm still having a problem understanding it. However I want to make sure that I am properly protected. I wrote a function in Classic ASP to help prevent a SQL Injection or possible brute force to the DB. Could you guys give me your own input and suggestions if I need to add to it or remove things or even correct issues to make it more secure? Thank you very much in advance!!

I use this below right before inserting in to a MySQL database.

An example insert:

conn.execute("INSERT INTO " & employees & "(eid, first_name, last_name) VALUES('" & Clng(strEID) & "','" & SQLClean(strfirstname) & "','" & SQLClean(strlastname) & "');")

The function:

Private Function SQLClean(ByVal strString)
    If strString <> "" Then
        strString = Trim(strString)

        'Remove malisous charcters from sql\
        strString = replace(strString,"-shutdown","", 1, -1, 1)
        strString = replace(strString,"\","\\", 1, -1, 1)
        strString = replace(strString,"=","\=", 1, -1, 1)
        strString = replace(strString,",","\,", 1, -1, 1)
        strString = replace(strString,"`","\`", 1, -1, 1)
        strString = replace(strString,"&","\&", 1, -1, 1)
        strString = replace(strString,"/","\/", 1, -1, 1)      
        strString = replace(strString,"[","\[", 1, -1, 1)
        strString = replace(strString,"]","\]", 1, -1, 1)
        strString = replace(strString,"{","\{", 1, -1, 1)
        strString = replace(strString,"}","\}", 1, -1, 1)
        strString = replace(strString,"(","\(", 1, -1, 1)
        strString = replace(strString,")","\)", 1, -1, 1)
        strString = replace(strString,";","\;", 1, -1, 1)
        strString = replace(strString,"+","\+", 1, -1, 1)
        strString = replace(strString,"<","\<", 1, -1, 1)
        strString = replace(strString,">","\>", 1, -1, 1)
        strString = replace(strString,"^","\^", 1, -1, 1)
        strString = replace(strString,"@","\@", 1, -1, 1)
        strString = replace(strString,"$","\$", 1, -1, 1)
        strString = replace(strString,"%","\%", 1, -1, 1)
        strString = replace(strString,"!","\!", 1, -1, 1)
        strString = replace(strString,"*","\*", 1, -1, 1)
        strString = replace(strString,"~","\~", 1, -1, 1)
        strString = replace(strString,"#","\#", 1, -1, 1)
        strString = replace(strString,"?","\?", 1, -1, 1)
        strString = replace(strString,"'","\'", 1, -1, 1)
        strString = replace(strString,"""","\""", 1, -1, 1)
        strString = replace(strString,"select","\select", 1, -1, 1)
        strString = replace(strString,"insert","\insert", 1, -1, 1)
        strString = replace(strString,"update","\update", 1, -1, 1)
        strString = replace(strString,"delete","\delete", 1, -1, 1)
        strString = replace(strString," or "," \or ", 1, -1, 1)
        strString = replace(strString," and "," \and ", 1, -1, 1)
        strString = replace(strString,"drop","\drop", 1, -1, 1)
        strString = replace(strString,"union","\union", 1, -1, 1)
        strString = replace(strString,"into","\into", 1, -1, 1)

        'Return cleaned value.
        SQLClean = Trim(strString)

    End If
End Function

Upvotes: 4

Views: 5014

Answers (2)

nageeb
nageeb

Reputation: 2042

Here's a good link to read up on for preventing SQL Injection Attacks in ASP Classic scripts.

It's also worth noting that you should always validate your variables, checking for proper values prior to dumping them in an SQL query. Checking for valid values is usually easier than checking for all the possible bad things that people can cram into the variables.

Upvotes: -1

tadman
tadman

Reputation: 211540

Please, DO NOT under any circumstances attempt to write your own SQL escaping code unless it is purely an academic exercise. You will get it wrong. If someone uses a SQL injection attack tool on your site you will suffer severe consequences. Businesses and careers have been destroyed by people taking a casual approach to this.

It took me all of three minutes to find an example on StackOverflow talking about Classic ASP and MySQL queries using parameters.

Please, please, please use the official facilities and do not roll your own.

Upvotes: 15

Related Questions