SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 351
Tools & Traps…
Designing an Input Validation and Handling Strategy
Input validation is a valuable tool for securing an application. However, it should be
only part of a defense-in-depth strategy, with multiple layers of defense contributing
to the application’s overall security. Here is an example of an input validation and
handling strategy utilizing some of the solutions presented in this chapter:
■■
■■
■■
■■
■■
■■
Whitelist input validation used at the application input layer to validate all
user input as it is accepted by the application. The application allows only
input that is in the expected form.
Whitelist input validation also performed at the client’s browser. This is
done to avoid a round trip to the server in case the user enters data that is
unacceptable. You cannot rely on this as a security control, as all data from
the user’s browser can be altered by an attacker.
Blacklist and whitelist input validation present at a Web application
firewall (WAF) layer (in the form of vulnerability “signatures” and
“learned” behavior) to provide intrusion detection/prevention capabilities
and monitoring of application attacks.
Parameterized statements used throughout the application to ensure that
safe SQL execution is performed.
Encoding used within the database to safely encode input when used in
dynamic SQL.
Data extracted from the database appropriately encoded before it is used.
For example, data being displayed in the browser is encoded for cross-site
scripting (XSS).
Blacklisting
Blacklisting is the practice of only rejecting input that is known to be bad. This commonly
involves rejecting input that contains content that is specifically known to be malicious by
looking through the content for a number of “known bad” characters, strings, or patterns.
This approach is generally weaker than whitelist validation because the list of potentially bad
characters is extremely large, and as such any list of bad content is likely to be large, slow to
run through, incomplete, and difficult to keep up to date.
A common method of implementing a blacklist is also to use regular expressions, with a
list of characters or strings to disallow, such as the following example:
'|%|--|;|/\*|\\\*|_|\[|@|xp_