CODEWITHSUNDEEP
sqlcoldfusionsql-injection
HPWD
HPWD

Reputation: 2240

Is this an example of an SQL Injection Attack?

I developed a web site for a client where they will post images of their merchandise online. The url is www.domiainname.com/item-details.cfm?sku=125. Someone tried browsing to www.domiainname.com/item-details.cfm?sku=125%20and%203=3 which produced and error in which I'm notified.

I've also received error reports of:

item-details.cfm?sku=1291+or+1=@@version-- 
item-details.cfm?sku=1291'+or+1=@@version 
item-details.cfm?sku=1291+or+1=@@version

The last three examples are definitely of someone trying to get into the system, right?

If we converted this to be stored procedures, would that reduce or eliminate the risk of insertion attacks?

Upvotes: 9

Views: 5169

Answers (3)

Vitalii Lebediev
Vitalii Lebediev

Reputation: 662

Yep, someone attempted SQL injection. If you check the sku variable correctly in your code, this will not do any harm.

Upvotes: 0

cetver
cetver

Reputation: 11829

Use cfqueryparam and forget about any sql-injection ;)

Upvotes: 2

James Hill
James Hill

Reputation: 61812

Yes, it appears that someone is being malicious.

Using cfqueryparam will prevent SQL-injection attacks. When in doubt (and it's CF), ask Ben:

SQL Injection Attacks, Easy To Prevent, But Apparently Still Ignored

Example:

<cfquery ...>
    SELECT    *
    FROM      Products
    WHERE     SKU=<cfqueryparam value="#URL.SKU#" cfsqltype="CF_SQL_INTEGER">
</cfquery>

Upvotes: 8

Related Questions