On Mon, Jan 18, 2010 at 12:44 PM, <[email protected]> wrote: > As far as specific testing tools, I think good practice and code reviews > are one of the best things here. You should be able to look at a query > and spot any dynamic parts that are out of a cfqueryparam or not > sanitized in some other way. The key really is separating parameters > from executable code.
Yes, vulnerability scanners are really not the entire solution. Code reviews and developing secure coding practices is the best long term solution. A scanner may not pick up a brand new vulnerability, but if you are using secure code practices you can more easily measure any new vulnerability's impact. -Cameron . ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:329758 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
