On 02/01/06 13:45 +0100, Sen, Adem wrote: > Hi @all! > > I have invested some time to think about detecting & preventing SQL > Injection attacks to web-applications. > Like many of us know, there are several methods to filter dangerous > input in web-applications, e.g. searching for specific RegEx Pattern and > so on. > > I have built following (primitive) RegEx Pattern to filter input to my > private used web-apps: > > RegEx Start > /SELECT|INSERT|UPDATE|ALTER|CREATE|DELETE|DROP|FROM|WHERE|OR|AND|LIKE|EX > EC|SP_|XP_|SQL|ROWSET|OPEN|BEGIN|END|DECLARE|;|--|-|'|\(|\)|=|>|<|@/i"; > /RegEx End > Ugh! Why do you not use stored procedures and bind parameters, which is the right way to do it?
Devdas Bhagat _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
