SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 365
should be rejected. For other types of Unicode, you should consult the documentation for
the framework you are using to determine whether functionality is available for testing the
validity of input.
Table 8.7 UTF-8 Parsing Regular Expressions
Regular expression
Description
[x00-\x7F]
ASCII
[\xC2-\xDF][\x80-\xBF]
Two-byte representation
\xE0[\xA0-\xBF][\x80-\xBF]
Two-byte representation
[\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}
Three-byte representation
\xED[\x80-\x9F][\x80-\xBF]
Three-byte representation
\xF0[\x90-\xBF][\x80-\xBF]{2} Planes 1 through 3
[\xF1-\xF3][\x80-\xBF]{3} Planes 4 through 15
\xF4[\x80-\x8F][\x80-\xBF]{2} Plane 16
Now that you have checked that the input is validly formed, you can convert it to a
predictable format—for example, converting a Unicode UTF-8 string to another character
set such as ISO-8859-1 (Latin 1).
In Java, you can use the CharsetEncoder class, or the simpler string method getBytes( )
( Java 6 and later) as follows:
string ascii = utf8.getBytes("ISO-8859-1");
In C#, you can use the Encoding.Convert class as follows:
ASCIIEncoding ascii = new ASCIIEncoding();
UTF8Encoding utf8 = new UTF8Encoding();
byte[] asciiBytes = Encoding.Convert(utf8, ascii, utf8Bytes);
In PHP, you can do this with utf8_decode as follows:
$ascii = utf8_decode($utf8string);
Designing to Avoid the
Dangers of SQL Injection
The material in the solutions I’ve described in this chapter comprises patterns that you can
use to secure your applications against SQL injection, and in most cases they are techniques
you can apply to both an application under development and an existing application,
albeit with some rework to the original application’s architecture. This solution is intended
to provide a number of higher-level design techniques to avoid or mitigate the dangers of