Re: SQL Injection Basics

SQL Injection works only when

1. SELECT * FROM foo WHERE foobar = $var
2. SELECT * FROM foo WHERE foobar = '$var'

In number 1, if the variable is not checked for the type of integer people can submit for example
/urlstring/index.cfm?var=1; AND NASTY CODE HERE

In number 2, if the variable is not checked for tick marks, and does not escape any that are found
/urlstring/index.cfm?var=blah' AND NASTY CODE HERE --

In ColdFusion ALL ticks submitted are escaped, I'm sure more languages out there do that.
Anyway, what I am after is the backdoor, the Unicode equivalent... Anyone?

I got this %25%32%37 from Davy, which makes sense but still does not work with ColdFusion
The following is the result

SELECT     category
FROM        mytable

I am trying to find all possible ways for SQL Insertion so I can protect myself against it.
Like I said I already convert any charters like ' () < > to its HTML equivalent, but I beleive there is a way to get around this with Unicode, but not sure...

• Original Message ----- From: "Nick Jacobsen" <nick@ethicsdesign.com> To: <dhurst@spidynamics.com>; <webappsec@securityfocus.com> Sent: Tuesday, February 11, 2003 7:37 AM Subject: Re: SQL Injection Basics

> Right, I wasn't thinking too well... makes sense. Though, according to
used
> SQL injection on some code where the developer used NO tick marks, but
Received on Mon Feb 10 17:35:59 2003

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek