SecurityFocus

Fwd: PHP Easter Eggs Nov 28 2004 01:21PM
Andi McLean (andi_mclean ntlworld com) (6 replies)

Re: PHP Easter Eggs Nov 30 2004 04:19AM
Serban Gh. Ghita (serban verasys ro)

Re: PHP Easter Eggs Nov 30 2004 04:12AM
Serban Gh. Ghita (serban verasys ro) (2 replies)

Re: PHP Easter Eggs Nov 30 2004 02:40AM
Harrison Gladden (hgladden gmail com) (4 replies)

Re: PHP Easter Eggs Dec 06 2004 09:45PM
Antonio Varni (antonio varni gmail com)

RE: PHP Easter Eggs Nov 30 2004 07:39PM
V. Poddubnyy (vpoddubniy mail ru)

Re: PHP Easter Eggs Nov 30 2004 02:40AM
Harrison Gladden (hgladden gmail com) (4 replies)

Re: PHP Easter Eggs Dec 06 2004 09:45PM
Antonio Varni (antonio varni gmail com)

RE: PHP Easter Eggs Nov 30 2004 07:39PM
V. Poddubnyy (vpoddubniy mail ru)

Re: Fwd: PHP Easter Eggs Nov 29 2004 08:54PM
Alexander Klimov (alserkli inbox ru)

Re: Fwd: PHP Easter Eggs Nov 29 2004 04:17PM
Saqib N Ali seagate com (2 replies)

Re: Fwd: PHP Easter Eggs Nov 30 2004 08:53AM
exon (exon home se) (2 replies)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC

Quite interesting.
But I couldn't get it work.

It works fine on query analyser,
but it didn't work when I try it on the application side (on the browser).
(I used %0d%0a for the newline character)

May be it depends on the version of MSSQL or the service pack etc.
Could you tell us the version of the MSSQL on your side.

Thanks,
---
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]>

-----Original Message-----
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]]
Sent: Friday, December 10, 2004 12:53 AM
To: webappsec (at) securityfocus (dot) com [email concealed]
Subject: SQL injection (no single quotes used)

Hi all

While in Oracle escaping apostrophe (') character
seems to be enough protection for Sql Injection (I
think is not), this is not true for Sql Server. Here a
little example I think many of you will find useful.

For an on-the-fly query like:
Query = "select field1, field2... from table where id
= '" + FixSQL (FieldValue) + "'"

Where FixSQL will escape single quotes AKA apostrophe,
the following value for "FieldValue" will be
effective:

FieldValue = "(NewLine)GO(NewLine)Desired Sql
Sentence(NewLine)GO"

Final result is:
select field1, field2... from table where id = '
GO
Desired Sql Sentence
GO
'

Here the MS Documentation for GO Keyword:
<snip>
SQL Server utilities interpret GO as a signal that
they should send the current batch of Transact-SQL
statements to SQL Server. The current batch of
statements is composed of all statements entered since
the last GO, or since the start of the ad hoc session
or script if this is the first GO
</snip>

So one sentence become three, sentences one and three
will fail, but sentence two (the one of our interest)
will execute successfully.

Hope you find this interesting

Cheers,
-JC

_________________________________________________________
Do You Yahoo!?
Información de Estados Unidos y América Latina, en Yahoo! Noticias.
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 
But I couldn't get it work. 
 
It works fine on query analyser, 
but it didn't work when I try it on the application side (on the browser). 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> 
 
-----Original Message----- 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 
little example I think many of you will find useful. 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" 
 
Final result is: 
select field1, field2... from table where id = ' 
GO 
Desired Sql Sentence 
GO 
' 
 
Here the MS Documentation for GO Keyword: 
<snip> 
SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 
statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
or script if this is the first GO 
</snip> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) 
will execute successfully. 
 
Hope you find this interesting 
 
Cheers, 
-JC 
 
_________________________________________________________ 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 
But I couldn't get it work. 
 
It works fine on query analyser, 
but it didn't work when I try it on the application side (on the browser). 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> 
 
-----Original Message----- 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 
little example I think many of you will find useful. 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" 
 
Final result is: 
select field1, field2... from table where id = ' 
GO 
Desired Sql Sentence 
GO 
' 
 
Here the MS Documentation for GO Keyword: 
<snip> 
SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 
statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
or script if this is the first GO 
</snip> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) 
will execute successfully. 
 
Hope you find this interesting 
 
Cheers, 
-JC 
 
_________________________________________________________ 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 
But I couldn't get it work. 
 
It works fine on query analyser, 
but it didn't work when I try it on the application side (on the browser). 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> 
 
-----Original Message----- 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 
little example I think many of you will find useful. 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" 
 
Final result is: 
select field1, field2... from table where id = ' 
GO 
Desired Sql Sentence 
GO 
' 
 
Here the MS Documentation for GO Keyword: 
<snip> 
SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 
statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
or script if this is the first GO 
</snip> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) 
will execute successfully. 
 
Hope you find this interesting 
 
Cheers, 
-JC 
 
_________________________________________________________ <
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 
But I couldn't get it work. 
 
It works fine on query analyser, 
but it didn't work when I try it on the application side (on the browser). 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> 
 
-----Original Message----- 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 
little example I think many of you will find useful. 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" 
 
Final result is: 
select field1, field2... from table where id = ' 
GO 
Desired Sql Sentence 
GO 
' 
 
Here the MS Documentation for GO Keyword: 
<snip> 
SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 
statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
or script if this is the first GO 
</snip> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) 
will execute successfully. 
 
Hope you find this interesting 
 
Cheers, 
-JC 
 
_________________________________________________________ <
 
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 
But I couldn't get it work. 
 
It works fine on query analyser, 
but it didn't work when I try it on the application side (on the browser). 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> 
 
-----Original Message----- 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 
little example I think many of you will find useful. 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" 
 
Final result is: 
select field1, field2... from table where id = ' 
GO 
Desired Sql Sentence 
GO 
' 
 
Here the MS Documentation for GO Keyword: 
<snip> 
SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 
statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
or script if this is the first GO 
</snip> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) 
will execute successfully. 
 
Hope you find this interesting 
 
Cheers, 
-JC 
 
_________________________________________________________ <
 
 
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 

But I couldn't get it work. 
 
It works fine on query analyser, 
but it didn't work when I try it on the application side (on the browser). 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> 
 
-----Original Message----- 

From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 
little example I think many of you will find useful. 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" <
;br 
/> 
 
Final result is: 
select field1, field2... from table where id = ' 
GO 
Desired Sql Sentence 
GO 
' 
 
Here the MS Documentation for GO Keyword: 
<snip> 

SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 

statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
or script if this is the first GO 
</snip> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) 
will execute successfully. 
 
Hope you find this interesting 
 
Cheers, 
-JC 
 
_________________________________________________________ <
 
 
 
br/ 
> 
Do You Yahoo!? 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC 
 
Quite interesting. 
 
But I couldn't get it work. 
 
It works fine on query analyser, <br/&
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
gt; 
(I used %0d%0a for the newline character) 
 
May be it depends on the version of MSSQL or the service pack etc. 
Could you tell us the version of the MSSQL on your side. 
 
Thanks, 
; 
--- 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
;br 
/> 
 
-----Original Message----- 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
Sent: Friday, December 10, 2004 12:53 AM 
To: webappsec (at) securityfocus (dot) com [email concealed] 
Subject: SQL injection (no single quotes used) 
 
Hi all 
 
While in Oracle escaping apostrophe (') character <br/&
gt; 
seems to be enough protection for Sql Injection (I 
think is not), this is not true for Sql Server. Here a 

little example I think many of you will find useful. 
; 
 
For an on-the-fly query like: 
Query = "select field1, field2... from table where id 
= '" + FixSQL (FieldValue) + "'" <
br/ 
> 
 
Where FixSQL will escape single quotes AKA apostrophe, 
the following value for "FieldValue" will be 
effective: 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql 
Sentence(NewLine)GO" <
; 
;br 
/> 
 
Final result is: 
select field1, field2... from table where id = ' 

GO 
Desired Sql Sentence <br/&g
t; 
GO 
' 

 
Here the MS Documentation for GO Keyword: <br/&g
t; 
<snip> 
 
SQL Server utilities interpret GO as a signal that 
they should send the current batch of Transact-SQL 
 
statements to SQL Server. The current batch of 
statements is composed of all statements entered since 
the last GO, or since the start of the ad hoc session 
; 
or script if this is the first GO 
</snip> <
br/ 
> 
 
So one sentence become three, sentences one and three 
will fail, but sentence two (the one of our interest) <br/&
gt; 
will execute successfully. <
br/ 
> 
 
Hope you find this interesting 
 
Cheers, 
; 
-JC 
 
_________________________________________________________ <
 
 
 
 
br/ 
> 
Do You Yahoo!? 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: Fwd: PHP Easter Eggs Nov 30 2004 08:53AM
exon (exon home se) (2 replies)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
br/ 
> 
 
Quite interesting. 
r/> 
 
But I couldn't get it work. &
lt; 
br/> 
 
It works fine on query analyser, <br/&
amp; 
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
gt; 
(I used %0d%0a for the newline character) <br/
 
> 
 
May be it depends on the version of MSSQL or the service pack etc. &l
t;b 
r/> 
Could you tell us the version of the MSSQL on your side. &
lt; 
br/> 
 
Thanks, 
; 
; 
--- <
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
;br 
/> 
 
-----Original Message----- 
r/> 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
/> 
Sent: Friday, December 10, 2004 12:53 AM <
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
> 
Subject: SQL injection (no single quotes used) &
lt; 
br/> 
 
Hi all <
;br 
/> 
 
While in Oracle escaping apostrophe (') character <br/&
amp; 
gt; 
seems to be enough protection for Sql Injection (I <
br/ 
> 
think is not), this is not true for Sql Server. Here a 
 
little example I think many of you will find useful. 
; 
; 
 
For an on-the-fly query like: &
lt; 
br/> 
Query = "select field1, field2... from table where id <
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
br/ 
> 
 
Where FixSQL will escape single quotes AKA apostrophe, 
/> 
the following value for "FieldValue" will be <
br/ 
> 
effective: <br/
 
> 
 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
;br 
/> 
 
Final result is: <
;br 
/> 
select field1, field2... from table where id = ' 
 
GO <
br/ 
> 
Desired Sql Sentence <br/&a
mp;g 
t; 
GO <
br/ 
> 
' 
 
 
Here the MS Documentation for GO Keyword: <br/&a
mp;g 
t; 
<snip> 
r/> 
 
SQL Server utilities interpret GO as a signal that &l
t;b 
r/> 
they should send the current batch of Transact-SQL 
r/> 
 
statements to SQL Server. The current batch of <
br/ 
> 
statements is composed of all statements entered since &
lt; 
br/> 
the last GO, or since the start of the ad hoc session 
; 
; 
or script if this is the first GO <
br/ 
> 
</snip> <
 
br/ 
> 
 
So one sentence become three, sentences one and three &
lt; 
br/> 
will fail, but sentence two (the one of our interest) <br/&
amp; 
gt; 
will execute successfully. <
 
br/ 
> 
 
Hope you find this interesting 
/> 
 
Cheers, 
; 
; 
-JC <
;br 
/> 
 
_________________________________________________________ <
 
 
 
 
 
br/ 
> 
Do You Yahoo!? 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
br/ 
> 
 
/> 
Quite interesting. 
 
r/> 
 
But I couldn't get it work. &
amp; 
lt; 
br/> 
 
/> 
It works fine on query analyser, <br/&
amp; 
amp; 
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
gt; 
(I used %0d%0a for the newline character) <br/
 
 
> 
 
/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;l 
t;b 
r/> 
Could you tell us the version of the MSSQL on your side. &
amp; 
lt; 
br/> 
 
/> 
Thanks, 
; 
; 
; 
--- <
; 
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
;br 
/> 
 
/> 
-----Original Message----- 
 
r/> 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
> 
Subject: SQL injection (no single quotes used) &
amp; 
lt; 
br/> 
 
/> 
Hi all <
; 
;br 
/> 
 
/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
gt; 
seems to be enough protection for Sql Injection (I <
 
br/ 
> 
think is not), this is not true for Sql Server. Here a 
r/> 
 
little example I think many of you will find useful. 
; 
; 
; 
 
/> 
For an on-the-fly query like: &
amp; 
lt; 
br/> 
Query = "select field1, field2... from table where id <
 
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
 
br/ 
> 
 
/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
/> 
the following value for "FieldValue" will be <
 
br/ 
> 
effective: <br/
 
 
> 
 
/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
; 
;br 
/> 
 
/> 
Final result is: <
; 
;br 
/> 
select field1, field2... from table where id = ' 
r/> 
 
GO <
 
br/ 
> 
Desired Sql Sentence <br/&a
mp;a 
mp;g 
t; 
GO <
 
br/ 
> 
' 
r/> 
 
 
/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;g 
t; 
<snip> 
 
r/> 
 
SQL Server utilities interpret GO as a signal that &a
mp;l 
t;b 
r/> 
they should send the current batch of Transact-SQL 
 
r/> 
 
statements to SQL Server. The current batch of <
 
br/ 
> 
statements is composed of all statements entered since &
amp; 
lt; 
br/> 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
or script if this is the first GO <
 
br/ 
> 
</snip> <
 
 
br/ 
> 
 
/> 
So one sentence become three, sentences one and three &
amp; 
lt; 
br/> 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
gt; 
will execute successfully. <
 
 
br/ 
> 
 
/> 
Hope you find this interesting 
 
/> 
 
/> 
Cheers, 
; 
; 
; 
-JC <
; 
;br 
/> 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
br/ 
> 
Do You Yahoo!? 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
 
br/ 
> 
 
 
/> 
Quite interesting. 
 
 
r/> 
 
But I couldn't get it work. &
amp; 
amp; 
lt; 
br/> 
 
 
/> 
It works fine on query analyser, <br/&
amp; 
amp; 
amp; 
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
amp; 
gt; 
(I used %0d%0a for the newline character) <br/
 
 
 
> 
 
 
/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;a 
mp;l 
t;b 
r/> 
Could you tell us the version of the MSSQL on your side. &
amp; 
amp; 
lt; 
br/> 
 
 
/> 
Thanks, 
; 
; 
; 
; 
--- <
; 
; 
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
; 
;br 
/> 
 
 
/> 
-----Original Message----- 
 
 
r/> 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
 
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
> 
Subject: SQL injection (no single quotes used) &
amp; 
amp; 
lt; 
br/> 
 
 
/> 
Hi all <
; 
; 
;br 
/> 
 
 
/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
amp; 
gt; 
seems to be enough protection for Sql Injection (I <
 
 
br/ 
> 
think is not), this is not true for Sql Server. Here a 
 
r/> 
 
little example I think many of you will find useful. 
; 
; 
; 
; 
 
 
/> 
For an on-the-fly query like: &
amp; 
amp; 
lt; 
br/> 
Query = "select field1, field2... from table where id <
 
 
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
 
 
br/ 
> 
 
 
/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
 
/> 
the following value for "FieldValue" will be <
 
 
br/ 
> 
effective: <br/
 
 
 
> 
 
 
/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
; 
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
; 
; 
;br 
/> 
 
 
/> 
Final result is: <
; 
; 
;br 
/> 
select field1, field2... from table where id = ' 
 
r/> 
 
GO <
 
 
br/ 
> 
Desired Sql Sentence <br/&a
mp;a 
mp;a 
mp;g 
t; 
GO <
 
 
br/ 
> 
' 
 
r/> 
 
 
 
/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;g 
t; 
<snip> 
 
 
r/> 
 
SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;l 
t;b 
r/> 
they should send the current batch of Transact-SQL 
 
 
r/> 
 
statements to SQL Server. The current batch of <
 
 
br/ 
> 
statements is composed of all statements entered since &
amp; 
amp; 
lt; 
br/> 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
; 
or script if this is the first GO <
 
 
br/ 
> 
</snip> <
 
 
 
br/ 
> 
 
 
/> 
So one sentence become three, sentences one and three &
amp; 
amp; 
lt; 
br/> 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
amp; 
gt; 
will execute successfully. <
 
 
 
br/ 
> 
 
 
/> 
Hope you find this interesting 
 
 
/> 
 
 
/> 
Cheers, 
; 
; 
; 
; 
-JC <
; 
; 
;br 
/> 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
 
 
br/ 
> 
 
 
 
/> 
Quite interesting. 
 
 
 
r/> 
 
But I couldn't get it work. &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
/> 
It works fine on query analyser, <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
(I used %0d%0a for the newline character) <br/
 
 
 
 
> 
 
 
 
/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Could you tell us the version of the MSSQL on your side. &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
/> 
Thanks, 
; 
; 
; 
; 
; 
--- <
; 
; 
; 
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
; 
; 
;br 
/> 
 
 
 
/> 
-----Original Message----- 
 
 
 
r/> 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
 
 
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
> 
Subject: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
/> 
Hi all <
; 
; 
; 
;br 
/> 
 
 
 
/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
seems to be enough protection for Sql Injection (I <
 
 
 
br/ 
> 
think is not), this is not true for Sql Server. Here a 
 
 
r/> 
 
little example I think many of you will find useful. 
; 
; 
; 
; 
; 
 
 
 
/> 
For an on-the-fly query like: &
amp; 
amp; 
amp; 
lt; 
br/> 
Query = "select field1, field2... from table where id <
 
 
 
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
 
 
 
br/ 
> 
 
 
 
/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
 
 
/> 
the following value for "FieldValue" will be <
 
 
 
br/ 
> 
effective: <br/
 
 
 
 
> 
 
 
 
/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
; 
; 
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
/> 
Final result is: <
; 
; 
; 
;br 
/> 
select field1, field2... from table where id = ' 
 
 
r/> 
 
GO <
 
 
 
br/ 
> 
Desired Sql Sentence <br/&a
mp;a 
mp;a 
mp;a 
mp;g 
t; 
GO <
 
 
 
br/ 
> 
' 
 
 
r/> 
 
 
 
 
/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;g 
t; 
<snip> 
 
 
 
r/> 
 
SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
they should send the current batch of Transact-SQL 
 
 
 
r/> 
 
statements to SQL Server. The current batch of <
 
 
 
br/ 
> 
statements is composed of all statements entered since &
amp; 
amp; 
amp; 
lt; 
br/> 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
; 
; 
or script if this is the first GO <
 
 
 
br/ 
> 
</snip> <
 
 
 
 
br/ 
> 
 
 
 
/> 
So one sentence become three, sentences one and three &
amp; 
amp; 
amp; 
lt; 
br/> 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
will execute successfully. <
 
 
 
 
br/ 
> 
 
 
 
/> 
Hope you find this interesting 
 
 
 
/> 
 
 
 
/> 
Cheers, 
; 
; 
; 
; 
; 
-JC <
; 
; 
; 
;br 
/> 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
br/ <
; 
;br 
/> 
> &a
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Nov 30 2004 06:24PM
Paul Fierro (pablo nothing com) (2 replies)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
 
 
 
br/ 
> 
 
 
 
 
/> 
Quite interesting. 
 
 
 
 
r/> 
 
But I couldn't get it work. &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
/> 
It works fine on query analyser, <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
(I used %0d%0a for the newline character) <br/
 
 
 
 
 
> 
 
 
 
 
/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Could you tell us the version of the MSSQL on your side. &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
/> 
Thanks, 
; 
; 
; 
; 
; 
; 
--- <
; 
; 
; 
; 
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
 
r/> 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
 
 
 
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
> 
Subject: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
/> 
Hi all <
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
seems to be enough protection for Sql Injection (I <
 
 
 
 
br/ 
> 
think is not), this is not true for Sql Server. Here a 
 
 
 
r/> 
 
little example I think many of you will find useful. 
; 
; 
; 
; 
; 
; 
 
 
 
 
/> 
For an on-the-fly query like: &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
Query = "select field1, field2... from table where id <
 
 
 
 
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
 
 
 
 
br/ 
> 
 
 
 
 
/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
 
 
 
/> 
the following value for "FieldValue" will be <
 
 
 
 
br/ 
> 
effective: <br/
 
 
 
 
 
> 
 
 
 
 
/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
; 
; 
; 
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
Final result is: <
; 
; 
; 
; 
;br 
/> 
select field1, field2... from table where id = ' 
 
 
 
r/> 
 
GO <
 
 
 
 
br/ 
> 
Desired Sql Sentence <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
GO <
 
 
 
 
br/ 
> 
' 
 
 
 
r/> 
 
 
 
 
 
/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
<snip> 
 
 
 
 
r/> 
 
SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
they should send the current batch of Transact-SQL 
 
 
 
 
r/> 
 
statements to SQL Server. The current batch of <
 
 
 
 
br/ 
> 
statements is composed of all statements entered since &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
; 
; 
; 
or script if this is the first GO <
 
 
 
 
br/ 
> 
</snip> <
 
 
 
 
 
br/ 
> 
 
 
 
 
/> 
So one sentence become three, sentences one and three &
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
will execute successfully. <
 
 
 
 
 
br/ 
> 
 
 
 
 
/> 
Hope you find this interesting 
 
 
 
 
/> 
 
 
 
 
/> 
Cheers, 
; 
; 
; 
; 
; 
; 
-JC <
; 
; 
; 
; 
;br 
/> 
 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
br/ <
; 
; 
;br 
/> 
> &a
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
 
 
 
 
br/ 
> 
 
 
 
 
 
/> 
Quite interesting. 
 
 
 
 
 
r/> 
 
 
But I couldn't get it work. &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
/> 
It works fine on query analyser, <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
(I used %0d%0a for the newline character) <br/
 
 
 
 
 
 
> 
 
 
 
 
 
/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Could you tell us the version of the MSSQL on your side. &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
/> 
Thanks, 
; 
; 
; 
; 
; 
; 
; 

--- <
; 
; 
; 
; 
; 
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
 
 
r/> 
 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
 
/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
 
 
 
 
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
 
> 
Subject: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
/> 
Hi all <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
seems to be enough protection for Sql Injection (I <
 
 
 
 
 
br/ 
> 
think is not), this is not true for Sql Server. Here a 
 
 
 
 
r/> 
 
little example I think many of you will find useful. 
; 
; 
; 
; 
; 
; 
; 

 
 
 
 
 
/> 
For an on-the-fly query like: &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
Query = "select field1, field2... from table where id <
 
 
 
 
 
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
 
 
 
 
 
br/ 
> 
 
 
 
 
 
/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
 
 
 
 
/> 
the following value for "FieldValue" will be <
 
 
 
 
 
br/ 
> 
effective: <br/
 
 
 
 
 
 
> 
 
 
 
 
 
/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
; 
; 
; 
; 
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
/> 
Final result is: <
; 
; 
; 
; 
; 
;br 
/> 
select field1, field2... from table where id = ' 
 
 
 
 
r/> 
 
GO <
 
 
 
 
 
br/ 
> 
Desired Sql Sentence <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
GO <
 
 
 
 
 
br/ 
> 
' 
 
 
 
 
r/> 
 
 
 
 
 
 
/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; 
<snip> 
 
 
 
 
 
r/> 
 
 
SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
they should send the current batch of Transact-SQL 
 
 
 
 
 
r/> 
 
 
statements to SQL Server. The current batch of <
 
 
 
 
 
br/ 
> 
statements is composed of all statements entered since &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
; 
; 
; 
; 

or script if this is the first GO <
 
 
 
 
 
br/ 
> 
</snip> <
 
 
 
 
 
 
br/ 
> 
 
 
 
 
 
/> 
So one sentence become three, sentences one and three &
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
will execute successfully. <
 
 
 
 
 
 
br/ 
> 
 
 
 
 
 
/> 
Hope you find this interesting 
 
 
 
 
 
/> 
 
 
 
 
 
/> 
Cheers, 
; 
; 
; 
; 
; 
; 
; 

-JC <
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
br/ <
; 
; 
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
; 

Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Dec 02 2004 04:35AM
Jimi Thompson (jimi thompson gmail com) (4 replies)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (6 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
 
 
 
 
 
br/ 
> 
 
 
 
 
 
 
/> 
Quite interesting. 
 
 
 
 
 
 
r/> 
 
 
 
But I couldn't get it work. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
 
 
 
 
 
 
/> 
It works fine on query analyser, <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
(I used %0d%0a for the newline character) <br/
 
 
 
 
 
 
 
> &l
t;b 
r/> 
 
 
 
 
 
 
/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
Could you tell us the version of the MSSQL on your side. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
 
 
 
 
 
 
/> 
Thanks, 
; 
; 
; 
; 
; 
; 
; 

; 
 
--- <
; 
; 
; 
; 
; 
; 
;br 
/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
 
/> 
-----Original Message----- 
 
 
 
 
 
 
r/> 
 
 
 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
 
 
/> &
lt; 
br/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
 
 
 
 
 
br/ 
> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
 
 
> &l
t;b 
r/> 
Subject: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
 
 
 
 
 
 
/> 
Hi all <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
 
/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
seems to be enough protection for Sql Injection (I <
 
 
 
 
 
 
br/ 
> 
think is not), this is not true for Sql Server. Here a 
 
 
 
 
 
r/> 
 
 
little example I think many of you will find useful. 
; 
; 
; 
; 
; 
; 
; 

; 
 
 
 
 
 
 
 
/> 
For an on-the-fly query like: &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
Query = "select field1, field2... from table where id <
 
 
 
 
 
 
br/ 
> 
= '" + FixSQL (FieldValue) + "'" <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
 
 
 
 
 
 
/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
 
 
 
 
 
/> &
lt; 
br/> 
the following value for "FieldValue" will be <
 
 
 
 
 
 
br/ 
> 
effective: <br/
 
 
 
 
 
 
 
> &l
t;b 
r/> 
 
 
 
 
 
 
/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
; 
; 
; 
; 
; 
;br 
/> 
Sentence(NewLine)GO" <
; 
; 
; 
; 
; 
; 
; 

; 
 
;br <
; 
;br 
/> 
/> &
amp; 
lt; 
br/> 
 
 
 
 
 
 
/> 
Final result is: <
; 
; 
; 
; 
; 
; 
;br 
/> 
select field1, field2... from table where id = ' 
 
 
 
 
 
r/> 
 
 
GO <
 
 
 
 
 
 
br/ 
> 
Desired Sql Sentence <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; <
br/ 
> 
GO <
 
 
 
 
 
 
br/ 
> 
' 
 
 
 
 
 
r/> 
 
 
 
 
 
 
 
 
/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g 
t; <
br/ 
> 
<snip> 
 
 
 
 
 
 
r/> 
 
 
 
SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
 
they should send the current batch of Transact-SQL 
 
 
 
 
 
 
r/> 
 
 
 
statements to SQL Server. The current batch of <
 
 
 
 
 
 
br/ 
> 
statements is composed of all statements entered since &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
; 
; 
; 
; 

; 
 
or script if this is the first GO <
 
 
 
 
 
 
br/ 
> 
</snip> <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
 
 
 
 
 
 
/> 
So one sentence become three, sentences one and three &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; 
br/> 
; 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
will execute successfully. <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
 
 
 
 
 
 
/> 
Hope you find this interesting 
 
 
 
 
 
 
/> &
lt; 
br/> 
 
 
 
 
 
 
/> 
Cheers, 
; 
; 
; 
; 
; 
; 
; 

; 
 
-JC <
; 
; 
; 
; 
; 
; 
;br 
/> 
 
 
 
 
 
 
/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
 
 
 
/> 
br/ <
; 
; 
; 
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
; 

; 
 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
gt; <
;br 
/> 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Hi JC <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Quite interesting. 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
But I couldn't get it work. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
It works fine on query analyser, <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
but it didn't work when I try it on the application side (on the browser). <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
(I used %0d%0a for the newline character) <br/
 
 
 
 
 
 
 
 
> &a
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
May be it depends on the version of MSSQL or the service pack etc. &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
Could you tell us the version of the MSSQL on your side. &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Thanks, 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
--- <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
Mutallip Ablimit <mutax (at) insi.co (dot) jp [email concealed]> <
; 
; 
; 
; 
; 
; 
; 

; 
 
;br <
; 
;br 
/> 
/> &
amp; 
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
-----Original Message----- 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
From: Juan Carlos Calderon [mailto:johnccr (at) yahoo (dot) com [email concealed]] 
 
 
 
 
 
 
 
/> &
amp; 
lt; 
br/> 
Sent: Friday, December 10, 2004 12:53 AM <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
To: webappsec (at) securityfocus (dot) com [email concealed] <br/
 
 
 
 
 
 
 
 
> &a
mp;l 
t;b 
r/> 
Subject: SQL injection (no single quotes used) &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Hi all <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
While in Oracle escaping apostrophe (') character <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
seems to be enough protection for Sql Injection (I <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
think is not), this is not true for Sql Server. Here a 
 
 
 
 
 
 
r/> 
 
 
 
little example I think many of you will find useful. 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
For an on-the-fly query like: &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
Query = "select field1, field2... from table where id <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
= '" + FixSQL (FieldValue) + "'" <
 
 
 
 
 
 
 
 
br/ <
; 
;br 
/> 
> &a
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Where FixSQL will escape single quotes AKA apostrophe, 
 
 
 
 
 
 
 
/> &
amp; 
lt; 
br/> 
the following value for "FieldValue" will be <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
effective: <br/
 
 
 
 
 
 
 
 
> &a
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
FieldValue = "(NewLine)GO(NewLine)Desired Sql <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
Sentence(NewLine)GO" <
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
;br <
; 
; 
;br 
/> 
/> &
amp; 
amp; 
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Final result is: <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
select field1, field2... from table where id = ' 
 
 
 
 
 
 
r/> 
 
 
 
GO <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
Desired Sql Sentence <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g &l
t;b 
r/> 
t; <
 
br/ 
> 
GO <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
' 
 
 
 
 
 
 
r/> 
 
 
 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Here the MS Documentation for GO Keyword: <br/&a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;g &l
t;b 
r/> 
t; <
 
br/ 
> 
<snip> 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
SQL Server utilities interpret GO as a signal that &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b <
;br 
/> 
r/> 
 
 
they should send the current batch of Transact-SQL 
 
 
 
 
 
 
 
r/> 
 
 
 
 
/> 
statements to SQL Server. The current batch of <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
statements is composed of all statements entered since &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
the last GO, or since the start of the ad hoc session 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
or script if this is the first GO <
 
 
 
 
 
 
 
br/ <
;br 
/> 
> &l
t;b 
r/> 
</snip> <
 
 
 
 
 
 
 
 
br/ <
; 
;br 
/> 
> &a
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
So one sentence become three, sentences one and three &
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
lt; <
;br 
/> 
br/> 
; 
; 
will fail, but sentence two (the one of our interest) <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
will execute successfully. <
 
 
 
 
 
 
 
 
br/ <
; 
;br 
/> 
> &a
mp;l 
t;b 
r/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Hope you find this interesting 
 
 
 
 
 
 
 
/> &
amp; 
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
Cheers, 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
-JC <
; 
; 
; 
; 
; 
; 
; 

;br <
;br 
/> 
/> &
lt; 
br/> 
 
 
 
 
 
 
 
/> &
lt; 
br/> 
_________________________________________________________ <
 
 
 
 
 
 
 
 
 
/> 
 
 
/> 
 
 
 
/> 
 
 
 
 
/> 
br/ <
; 
; 
; 
; 
; 
;br 
/> 
> &a
mp;a 
mp;a 
mp;a 
mp;a 
mp;l 
t;b 
r/> 
Do You Yahoo!? 
; 
; 
; 
; 
; 
; 
; 

; 
 
; 
r/> 
 
Información de Estados Unidos y América Latina, en Yahoo! Noticias. <br/&
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; 
amp; &l
t;b 
r/> 
gt; <
; 
;br 
/> 
Visítanos en http://noticias.espanol.yahoo.com

[ reply ]

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

SQL injection (no single quotes used) Dec 09 2004 03:53PM
Juan Carlos Calderon (johnccr yahoo com) (4 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 10:25AM
Mutallip Ablimit (mutax insi co jp) (2 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 11:20PM
PD9 Software (info pd9soft com)

Re: SQL injection (no single quotes used) Dec 15 2004 02:49AM
Olivier G. Gaumond (olig monimap com) (1 replies)

Re: SQL injection (no single quotes used) Dec 15 2004 04:50PM
Juan Carlos (johnccr yahoo com) (1 replies)

RE: SQL injection (no single quotes used) Dec 15 2004 11:12PM
Brett Moore (brett moore security-assessment com)

Re: SQL injection (no single quotes used) Dec 14 2004 07:30PM
Adam Tuliper (amt gecko-software com)

Re: PHP Easter Eggs Dec 02 2004 04:32PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: PHP Easter Eggs Nov 29 2004 04:04PM
Griffiths, Ian (ian griffiths liv-coll ac uk)

Re: Fwd: PHP Easter Eggs Nov 29 2004 03:43PM
Astarna (mailing astarna com)