Problem - Kevin Tafuro

*ptr++ = *c;
} while (*++c != ’>’);
*ptr++ = ’>’;
break;
}
case ’>’:
*ptr++ = ’&’; *ptr++ = ’g’; *ptr++ = ’t’; *ptr++ = ’;’;
break;
case ’&’:
*ptr++ = ’&’; *ptr++ = ’a’; *ptr++ = ’m’; *ptr++ = ’p’;
*ptr++ = ’;’;
break;
case ’'’:
*ptr++ = ’&’; *ptr++ = ’q’; *ptr++ = ’u’; *ptr++ = ’o’;
*ptr++ = ’t’; *ptr++ = ’t’;
break;
default:
*ptr++ = *c;
break;
}
}
*ptr = 0;
return output;
}
3.11 Preventing SQL Injection Attacks
Problem
You are developing an application that interacts with a SQLdatabase, and you need
to defend against SQL injection attacks.
Solution
SQLinjection attacks are most common in web applications that use a database to
store data, but they can occur anywhere that a SQLcommand string is constructed
from any type of input from a user. Specifically, a SQLinjection attack is mounted
by inserting characters into the command string that creates a compound command
in a single string. For example, suppose a query string is created with a WHERE clause
that is constructed from user input. A proper command might be:
SELECT * FROM people WHERE first_name="frank";
If the value “frank” comes directly from user input and is not properly validated, an
attacker could include a closing double quote and a semicolon that would complete
the SELECT command and allow the attacker to append additional commands. For
example:
SELECT * FROM people WHERE first_name="frank"; DROP TABLE people;
Preventing SQL Injection Attacks | 107
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.