0

I want to make my portal more secure from sql injection attack please help to implement sql injection preventions steps in classic ASP portal.

Insert record in database using select query like

insert into UserDetails(OfferID,Submittedby,PrimaryApprover,SecondaryApprover,SubmittedDate,Status,IsDeviation,RegionHeadApprover)  "&_
        "values("&objRsUserDetails("OfferID")&","&Session("id")&","&primSevaApprover&","&Approver1&",'"&now()&"',"&Objemail("Status")&","&Deviation&","&objgetRegionHead("HeadID")&")"
Charlieface
  • 52,284
  • 6
  • 19
  • 43
Ashapak Shaikh
  • 1
  • 2
    SQL Injection is the *vulnerability*, not the mitigation. Besides, the solution is exactly the same as in .NET - use parameterized queries. Parameterized queries were introduced (or at least became popular) with OLE DB and ADO several years before .NET was released. – Panagiotis Kanavos Jun 30 '21 at 13:42
  • @PanagiotisKanavos Please vote for a suitable duplicate – Charlieface Jun 30 '21 at 13:45
  • This means *don't* concatenate strings to create a SQL query. Use an [ADO Command](https://learn.microsoft.com/en-us/sql/ado/reference/ado-api/command-object-ado?view=sql-server-ver15) with a query string containing parameter names. Add the parameters to the command's [`Parameters` collection](https://learn.microsoft.com/en-us/sql/ado/reference/ado-api/parameters-collection-ado?view=sql-server-ver15) and set their values. The unfortunate difference is that there's no `using` statement to close the connection in case of error. – Panagiotis Kanavos Jun 30 '21 at 13:45
  • The [documentation of the Parameters collection](https://learn.microsoft.com/en-us/sql/ado/reference/ado-api/parameters-collection-ado?view=sql-server-ver15) contains a full example that shows how to create a `Command`, set its parameters and execute it. It's essentially the same as the ADO.NET code used in .NET. – Panagiotis Kanavos Jun 30 '21 at 13:46
  • Yup, parameterized / prepared statements are the way to go. A more primitive approach would be to create a function that first replaces any \ with \\, then ' with \', but parameterized statements should always be used if possible. – Adam Jun 30 '21 at 13:57
  • Using parameterised statements is the best way to go. However, there are times that's not appropriate depending on the situation. Although if you can use parameterised statements! So, if you have to do it like that rather than using parameterised statements at least encode the values properly. So have a function for example "SQLEncodeValue" that encodes the delimiter. So you could replace all apostrophes with double apostrophes. That way at least when you do some SQL and the value has a apostrophe in it - it won't break your SQL. – Simon Sawyer Jul 14 '21 at 14:14
  • Santization... filter the request variables so that nothing can be injected but the data that you want. Create a function using replace method to strip all known possibles that can cause injection woes. – WilliamK Apr 15 '22 at 07:48

0 Answers0