>Date: Mon, 13 Aug 2001 22:29:13 +0200
>From: Jochem van Dieten <[EMAIL PROTECTED]>
>Subject: Re: Hacking CF Web Sites and Applications
>Why a filter looking for words in a URL?
To help prevent hack attempts. In some situations, changing the values in a
certain locations can create huge security problems.
>AFAIK the issue is that code (like DROP, INSERT, DELETE, UPDATE, ALTER
>and possibly functions/vbscript etc.) is executed in the database. What
>code can be executed? Wouldn't that be code that is not escaped?
>So that
>means that everything between proper quotes is safe by definition. What
>is left is dates, numbers etc. Well, simply use cfqueryparam for them
>and you are done.
>
>Or am I misunderstanding something here?
That issue was the catalyst to this discussion, but the security issues
we're talking about (at least I am anyway) covers a much larger area.
>Jochem
>
>PS Some suggestions for Josh:- check formfields too
>- URLDECODE everything so you can use regex pattern matching
>(instead of ";%20DROP%20TABLE%20" match
>"[[:space:]]*;[[:space:]]*drop[[:space:]]*table[[:space:]]*" so I can't
>simply replace a space with a tab and bypass your filter
>- check for all the abovementioned statements
Thanks for the suggestion, Jochem, but my script already covers urls, forms
and cookies as well as looking for "altered" spaces.
I believe you're making suggestions based on the little example I gave,
which is not how my script is laid out. It was an altered, simplified
example to explain a point. (I make a habit of altering my code slightly
when posting it, so I can understand the confusion.) however I do appreciate
your comments.
================================
Josh - [EMAIL PROTECTED]
================================
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
FAQ: http://www.thenetprofits.co.uk/coldfusion/faq
Archives: http://www.mail-archive.com/[email protected]/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
