SQL injection prevention question

Updated: 21 May 2010 | 2 comments

MUHenry

0 0 Votes

Hi Everyone

During the testing of a workflow, we found out that it was possible to do SQL injection into the fields.

What we have is a form that collects the user's NT ID, then it passes the NT ID to a "FindServiceDeskContact" component.

And it seems like if we input strings such as

NTID';delete * from table

it will try to run the query against the helpdesk incident's database.

Does any know if there is anyway of sanitizing the input?

thanks in advance.

discussion Filed Under:

Endpoint Management, Workflow Solution, Database, IT Risk Management

Comments RSS Feed

Comments

Jul

2009

1 Vote +1

jz81

Sanitizing data using a RegEx

Hello MUHenry,

I'm not sure if this is the best way to do it, but the following definitely works. Add a replace common pattern control to your workflow. Set the data you want to sanitize as the input variable name. Set Reg Exp to (Custom), set Regular expression to something like this [^0-9a-zA-Z], set the Replace Variable Name to dynamic value (without any content) and set the output variable name (e.g. to sanitizedNTid). Now use the sanitizedNTid in your FindServiceDeskContact component.

I hope this helps,

Best regards,

John

Aug

2009

0 Votes 0

MUHenry

hi John, Thanks heaps for the

hi John,

Thanks heaps for the reply, that seems like a good method of sanitizing the input, I'll give it a shot.

SQL injection prevention question

Comments

Sanitizing data using a RegEx

hi John, Thanks heaps for the

Would you like to reply?

Links

Technical Support

Symantec.com

Store

Community Stats