CODEWITHSUNDEEP
asp-classicsql-injection
klork
klork

Reputation: 572

Classic ASP SQL Injection

I recently inherited a classic asp website with a ton of inline SQL insert statements that are vulnerable to SQL injection attacks.

These insert statements are executed via the ADO command object.

Will setting the ADO Command Object's Prepared property to true ensure that the query is parameterized before execution, thus mitigating the risk of SQL injection?

Upvotes: 8

Views: 18475

Answers (5)

Carter Cole
Carter Cole

Reputation: 924

What I would suggest you do is write a function to sanitize the user input, then run all the request variables through that. When I wrote mine I did stuff like:

  • escape single quotes,
  • remove ; and other special characters and
  • make sure that you couldn't -- (comment) out the end of the statement.

Most SQL injection would try something like ' or 1=1 or a=' so the SQL code would be :

SELECT * from mytable where mycolumn = '' or 1=1 or a=''

So escaping single quotes is the real big one you need to worry about.

Upvotes: -1

Jason Too Cool Webs
Jason Too Cool Webs

Reputation: 133

Here's another good link and example.

http://blogs.iis.net/nazim/archive/2008/04/28/filtering-sql-injection-from-classic-asp.aspx

In the past we just created a couple functions to handle any outside input for SQL injections and XSS. Then slowly we converted all the inline SQL to stored procedures.

Upvotes: 0

user213186
user213186

Reputation: 99

You can also look at an asp classic open source project called 'Owasp stinger'. That not only helps with Sql injection, but header injection and lots of other security issues common to all web apps.

http://www.owasp.org/index.php/Classic_ASP_Security_Project

Upvotes: 2

kevchadders
kevchadders

Reputation: 8335

This Link should prove useful.

Classic ASP SQL Injection Protection

Upvotes: 6

Hans Kesting
Hans Kesting

Reputation: 39255

No, if you build a SQL string with values that you get directly from "outside", then a "prepared statement" will not help you.

a 

sSQL = "SELECT * from mytable where mycolumn = '" + querystring("value") + "'"

is still asking for trouble. The only way to solve this is by using parameters in your query.

Upvotes: 6

Related Questions