Re: ISA Server and SQL Injection

Bogdan Tomchuk wrote:

> > > I'm not sure any firewall would stop a SQL Injection attack.
> > >     
> >
> > Web application firewall can do this. They filter http content.
> >   
>
>
> No, they cannot do it either.

There is some keyword or pattern which can be used to do this.
If some SQL syntax is detected in a parameter or in the url, there is 
more chance the request is insane than a normal traffic.

> Problem is the same: By seeing URL you have no
> reliable way to say which parameter will be used in SQL query and how
> (with/without transformation). Only application knew it.
>
>
>  
Yes sure, if you code application using in parameter some SQL query, you 
should read "howto do secure code for webapp"....
Application mainly use value after used by the application inside a 
query, but the query is in the code.

http://www.toto.com/test.php?product_id=4 is ok and there is NO WAY to 
see here some SQL Syntax.

http://www.toto.com/test.php?product_id=SELECT%20*%20FROM%20product%20WHERE 
%20id=4 is not ok, and you shoud fire developper doing this....

Using parameters values doing directly actions is "HACKER FRIENDLY!"