Database being corrupted by hackers

[praveenb000]

I have done a content management website http://sarasa.in, in asp. used sql server database.

this site database is being corrupting by some hackers. They are changing data with adding script tag to the existing data for some fields, and removing data for some fields in tables.

So, Im loosing my patience to rectify this problem. This happens repeatedly to this site even after clearing entire database and refresh the data.

How should I restrict hacker attacks to the data?

[GazMathias]

Hi,

You can sanitise user input before you use it to interact with the database.

Start by replacing ' with '' or (my personal preference) `

Also use the datatype conversion functions to force user input into a specific format. For example, using ID in this querystring:

somepage.asp?ID=1; DELETE * FROM tblSomeTable
 

Will not get past this:

ArticleID = CLng(request.querystring("ID"))
SQL = "SELECT * FROM tblSomeTable WHERE ID=" & ArticleID
 

It is also a good idea to use server.HTMLEncode, too.

Any other takers?

Gaz

[praveenb000]

@GazMathias
Hi GazMathias,

By searching several sites I find out loop holes in my code.

I followed the steps as you said. And reloaded the site again. I hope the problem is solved now.

Thank you very much for your response......

[jhardman]

filter out semicolons. it is fairly hard to do an injection attack without semicolons.

Make sure queries that are just looking up data and returning a recordset use a cursortype/locktype that do not allow modifying the db.

You could also use stored procedures and set each parameter that the user enters. This is considered a best practice by a lot of people.

And to top it off, if you can detect an attack, get the user's IP address

request.servervariables("REMOTE_ADDR")

and submit it to an IP blacklist.

Jared

[rodyron]

Dear Friend,
You can use a data recovery software for your corrupted sql database and get your data back there are so may software which help you one of them you can download from here http://www.restoresqldatabase.org/