Have Geek Brain

I need to parameterize against sql injection in asp classic, what should I take some time to find out before starting the changes?

Coming from PHP I have to do some sql cleanup on this 1000 page classic asp web application without any prior knowledge of asp and before I get to it I would like to know about any major bugs to follow to code in the asp classic / sql parameter when preparing / making ASP modifications. What are some good resources for a quick overview and what should I keep track of?

+2


a source to share


3 answers


  • I would create a function that encapsulates all or most of the data access. In previous projects, I created a function GetRecordset

    that takes a SQL statement and returns a Recordset instance. In this function, I open the database, execute the query, close the database, and return the recordset. This ensures that connections are closed.

  • I would create a parameter cleanup function for the SQL statement, or even better use parameterized queries. In code where I didn't want to rewrite the queries and thus used concatenation, the function I would use would require a parameter vbVarType

    so that I can check that the passed value is of the specified type and ensure that the dates are put in the format. not related to server culture.

  • I would look for instances of a single quote followed by a double quote. Here you are lookingSelect ... Where StringOrDateCol = '" & Request.QueryString("GodKnowsWhat") & ...



Even with all this, you will not catch everything. For example, you won't catch Select ...Where NumericCol = " & Request.QueryString("GodKnowsWhat")

. The end search may be searching for Select

, Update

, Insert

and Delete

and check each SQL statement to make sure it uses the function you created in # 2 above.

+1


a source


Make sure you are not using string concatenation to add parameter values ​​to the SQL query. Learn how to use the ADO Command and Parameter objects. Always use placeholders in your SQL query string and add Parameter objects to your command to specify the value for the placeholders.



+3


a source


Agreed ... A parameterized query via place-holder and ex: SqlDb.Command.Parameters.Add () would be a big help ... Don't just rely on choice, you can also have insert and delete injection too.

+1


a source






More articles:


All Articles