ASP Codes to prevent MSSQL Injection Data Cleaner for Database Security

This is a simple input field cleaner to help prevent SQL Injection problems. SQL Injection occurs when a hacker fills out a form on your web site or posts data to a script. If the script which accepts and processes the data reads or writes to a SQL database, the hacker can include SQL commands.

Those commands can insert data to your database and/or can output details about the tables and fields in your database.

There is much more to SQL injection, but this simple script will help to clean submitted data. It is intended for alphanumeric fields. You can clean numeric fields separately by testing for isNumeric and Not isNull.

ASP FUNCTIONS CODES

Function fncInputDataCleaner(StringToClean)

If Len(StringToClean) > 0 Then
For x = 1 to 3
StringToClean = Replace(stringToClean, "'", "''")
StringToClean = Replace(stringToClean, "--", "-")
StringToClean = Replace(stringToClean, ";", " ")
StringToClean = Replace(stringToClean, "<", " ") StringToClean = Replace(stringToClean, ">", " ")
StringToClean = Replace(stringToClean, "%", " ")
StringToClean = Replace(stringToClean, " Next
End If

CleanInputData = stringToClean

End Function



Instructions
Add this function to your Classic ASP script or include it in a file with commonly used functions. Call the function like this:

strMyName = Request("MyName")
strMyName = fncInputDataCleaner(strMyName)

How to find & Stop SQL injection attacks from happening

There’s a lot of stuff out there about SQL injection attacks , but there’s not much that will help you figure out how to stop these attacks from occurring.

First, let’s talk about what a SQL Injection Attack really is. Some people think it’s a virus of sorts, that is “inside your site.” Not the case. These are bot attacks by other virus infected computers. They simply use a brute force approach of scanning URLs that take POST/GET inputs and attempt to send their own data to them.

So, how do you track these down and stop them? For web sites powered by Microsoft’s IIS, here are our suggestions:

1.Look at your IIS logs
Try searching for the word “DECLARE” or “EXECUTE.” If you’ve been hit by an attack, these will more than likely show up in your IIS logs — at least for any attack that was attempted using “GET” posts. If you do find any instances of “DECLARE” or “EXECUTE” these are the pages to start with.

2.Use centralized database connection handling
Simple, make a centralized file (e.g. connection.asp if you are using ASP — see our free example) that handles all of your DB access. This way, it’s easier to make sure that you are SQL encoding your pages. You can easily search queries for “DECLARE” and “EXECUTE” and stop the attacks dead in their tracks.

3.Implement a site wide solution
If you are running your own server, we highly recommend ISAPI_Rewrite from HeliconTech (http://www.helicontech.com/isapi_rewrite). This is an ISAPI filter that allows you to do a variety of things, including scan URL data. This will stop 99% of attacks without changing ANY code on your site!