| Author |
 Topic  |
|
|
awenzel
Starting Member
4 Posts |
 Posted - July 12 2006 : 07:41:07
|
I just received the security note about adding calls to CleanChars() to sanitize user input. However, it's not clear to my why this is required. The query is of the form:
select *
from TABLE
where field1='value1'
and field2='value2'
The instructions are to further sanitize the values for value1 and value2. However, those values have already had all single-quote characters removed.
My question is this: since value1 and value2 are within single-quotes, how could someone perform a sql injection attack? Anything passed to sql in those values would just be treated as a string value, and not as any sort of sql comment, right?
Thanks for any insights.
Anthony
|
|
|
support
Administrator
4679 Posts |
Posted - July 12 2006 : 18:52:48
|
Hi Anthony,
Without going into too much detail, for security reasons, it is possible to complete a SQL injection of strings that are enclosed in single quotes by including single quotes in the injection string.
If the single quotes have already been cleansed from the strings then there should be no problem, but we are including the cleanchars call now as a matter of precaution.
If you have any further questions, we would be happy to answer them through our helpdesk at http://www.vpasp.com/virtprog/helpdesk
Regards,
Claire Banks
VP-ASP Support |
 |
|
|
awenzel
Starting Member
4 Posts |
Posted - July 14 2006 : 06:22:17
|
| Ok, that's what I thought. Thanks for the reply. |
|
|
| |
Topic |
|
All Forums
Why need CleanChars()?
New Topic
Printer Friendly
TrustGuard - PCI Security Scanner
