> With the recent SQL Injection talk, I was looking for ways to > setup monitoring and testing procedures to test for and monitor > SQL Injection.
One of the prevention tools that I made available a while back will find many SQL injection attempts and can stop them and notify you. It's not perfect but can act as a first line of defense for sites that haven't been well vetted. It's available at http://www.gravityfree.com/_sqlprev.cfm.txt. It doesn't stop some of the newer injection methods but I'm working to gather samples and code patches so that it can be improved. As for testing a site, I've found the McAfee Secure vulnerability scanner to be quite helpful in that regard. It's not free, but it's very thorough (not only with SQL injection, but in finding other problems as well). -Justin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:329760 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
