SQL Injection test

[Voodoo Jai]

I have a page the uses a form to pass a postcode to another page and I
want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.
I have limited the field to 10 chars so I know i would have to test it
with a larger field because a hacker could just rewrite the form and
use a lerger field for the attempted attack.

Many thanks in advance

VoodooJai

[Jerry Stuckle]

Voodoo Jai wrote:

I have a page the uses a form to pass a postcode to another page and I
want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.
I have limited the field to 10 chars so I know i would have to test it
with a larger field because a hacker could just rewrite the form and
use a lerger field for the attempted attack.

Many thanks in advance

VoodooJai

You need to test against the same things a hacker does - i.e. DELETE.
And you should NEVER be testing on a live system anyway - always test on
a development system, after backing up your databases.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Voodoo Jai]

On Oct 11, 1:27*pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:

Voodoo Jai wrote:

I have a page the uses a form to pass a postcode to another page and I
want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.
I have limited the field to 10 chars so I know i would have to test it
with a larger field because a hacker could just rewrite the form and
use a lerger field for the attempted attack.

Many thanks in advance

VoodooJai

You need to test against the same things a hacker does - i.e. DELETE.
And you should NEVER be testing on a live system anyway - always test on
a development system, after backing up your databases.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstuck...@attgl obal.net
=============== ===

I have backed up my db but dont know the syntax to use in the form,
could someone show me an example.

[Bill H]

On Oct 11, 9:06*am, Voodoo Jai <voodoo...@btin ternet.comwrote :

On Oct 11, 1:27*pm, Jerry Stuckle <jstuck...@attg lobal.netwrote:

Voodoo Jai wrote:

I have a page the uses a form to pass a postcode to another page and I
want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.
I have limited the field to 10 chars so I know i would have to test it
with a larger field because a hacker could just rewrite the form and
use a lerger field for the attempted attack.

Many thanks in advance

VoodooJai

You need to test against the same things a hacker does - i.e. DELETE.
And you should NEVER be testing on a live system anyway - always test on
a development system, after backing up your databases.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstuck...@attgl obal.net
=============== ===

I have backed up my db but dont know the syntax to use in the form,
could someone show me an example.- Hide quoted text -

- Show quoted text -

I've always wanted to be the one that says google is your friend. Use
your subject title and google it. 1st hit contains tools for testing
it (http://www.zubrag.com/tools/sql-injection-test.php), with about
640,000 other hits also.

Bill H

[=?UTF-8?B?SXbDoW4gU8OhbmNoZXogT3J0ZWdh?=]

Voodoo Jai wrote:

I have a page the uses a form to pass a postcode to another page and I
want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.

There are automated tools for testing against SQL injection attacks, and
what they usually do is to perform a query that pauses for 15 seconds or so
before continuing.

Therefore, if the software detects that fetching a page took 15 seconds more
than the average, the injection was successful.
Cheers,
--
----------------------------------
Iván Sánchez Ortega -ivan-algarroba-sanchezortega-punto-es-

Buying Microsoft anymore is like saying: Please, treat me like a two year
old, stifle my creativity and learning, keep me in the dark and feed me
crap, and whatever you do, don't let me question your 'authority'.

[Gordon Burditt]

>I have a page the uses a form to pass a postcode to another page and I

>want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.

As a quick and non-destructive test, if putting a single quote or
double quote in a field provokes a SQL error (you need to be logging
SQL errors or output any such errors on the page. Reporting SQL
errors to the web user (hacker) is *NOT* something you should leave
in production code.), you've potentially got trouble. (Plus, Mr.
O'Brian won't like it when he can't buy from your store). A backslash
at the end of a field is another thing to test. So is a semicolon.
If, instead of a SQL error, you get an error from the input-checking
portion of your code, (e.g. "Quantity must be a number"), you're
catching at least some of the bad input.

>I have limited the field to 10 chars so I know i would have to test it
with a larger field because a hacker could just rewrite the form and
use a lerger field for the attempted attack.

[Jerry Stuckle]

Voodoo Jai wrote:

I have this piece of code that was created in conjunction with
Dreamweaver and myself but I'm now a little lost as to what is what.
Could someone enlighten me a little.

Do you have any idea what this code does? Or is it just something you
let DreamWeaver create for you? From the looks of it, it's the latter.

You should NEVER trust another package like this to generate secure code
for you. You need to ALWAYS understand what it is doing.

In this case there is way too much extraneous code.

You need to learn PHP and forget about code generators like DreamWeaver.
They're okay for rapid prototyping, but not for a production system,
IMHO.

And if you know PHP, you can generate the correct code faster than you
can in DreamWeaver - and be assured it's safe, because you understand
what's going on.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Evans]

On 11 Oct, 10:38, Voodoo Jai <voodoo...@btin ternet.comwrote :

I have a page the uses a form to pass a postcode to another page and I
want to test it against an SQL Injection. What would be a safe (i.e NO
DELETING of data ) statement to try and how would I format this to try
in the form.
I have limited the field to 10 chars so I know i would have to test it
with a larger field because a hacker could just rewrite the form and
use a lerger field for the attempted attack.

Many thanks in advance

VoodooJai

Nice you asked, most people do not bother - they just put magic code
on production servers and hope that no one tries to inject toxic
queries into their system.

That said, if you're unsure of how to protect your system, I'd suggest
you contract it to a professional to sort out.

Good luck!

--
Evans
http://www.jroller.com/evans

[Jim Carlock]

"Evans" <on*****@gmail. comwrote...
: That said, if you're unsure of how to protect your system, I'd suggest
: you contract it to a professional to sort out.
: Good luck!

Your reply amounts to...

I don't have an answer. Get help from someone else. Good luck.

--
Jim Carlock
You Have More Than Five Senses
http://www.associatedcontent.com/art...ve_senses.html

[Jerry Stuckle]

Jim Carlock wrote:

"Evans" <on*****@gmail. comwrote...
: That said, if you're unsure of how to protect your system, I'd suggest
: you contract it to a professional to sort out.
: Good luck!

Your reply amounts to...

I don't have an answer. Get help from someone else. Good luck.

Not at all. His answer is right on the money. SQL injection is a
complicated subject - and way longer than can be handled in a few
newsgroup messages.

We can provide some *guidance* - but not the *understanding* needed to
protect a system.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===