SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 363
Table 8.6 Example Single-Quote Representations
Representation
Type of encoding
%27 URL encoding
%2527 Double URL encoding
%%317 Nested double URL encoding
%u0027 Unicode representation
%u02b9
Unicode representation
%ca%b9
Unicode representation
'
HTML entity
'
Decimal HTML entity
'
Hexadecimal HTML entity
%26apos;
Mixed URL/HTML encoding
In some cases, these are alternative encodings of the character (%27 is the URL-encoded
representation of the single quote), and in other cases these are double-encoded on the
assumption that the data will be explicitly decoded by the application (%2527 when
URL-decoded will be %27 as shown in Table 8.6, as will %%317) or are various Unicode
representations, either valid or invalid. Not all of these representations will be interpreted
as a single quote normally; in most cases, they will rely on certain conditions being in place
(such as decoding at the application, application server, WAF, or Web server level), and therefore
it will be very difficult to predict whether your application will interpret them this way.
For these reasons, it is important to consider canonicalization as part of your input
validation approach. Canonicalization is the process of reducing input to a standard or
simple form. For the single-quote examples in Table 8.6, this would normally be a
single-quote character (‘).
Canonicalization Approaches
So, what alternatives for handling unusual input should you consider? One method, which is
often the easiest to implement, is to reject all input that is not already in a canonical format.
For example, you can reject all HTML-and URL-encoded input from being accepted by
the application. This is one of the most reliable methods in situations where you are not
expecting encoded input. This is also the approach that is often adopted by default when
you do whitelist input validation, as you may not accept unusual forms of characters when
validating for known good input. At the very least, this could involve not accepting the
characters used to encode data (such as %, &, and # from the examples in Table 8.6),
and therefore not allowing these characters to be input.