Musings about my volunteer website security scan experiences....

…continued…

SQL injections should jump out of the original SQL statement.
methods: use of single quote (‘)
use of double dash (–)
(’) delimiter for a SQL query.
(–) comment character in Oracle/MS SQL.

/((')|C%27)|(--)|(#)|(%23)/ix(')|(%27) the single quite and URL-encoded equivalent.
(--) the double dash
(#)|(%23) the pound sign in it’s URL-encoded equivalent.

So detect hex equivalent of (') single quote itself or the presence of – at the beginning of a comment., so the rest that follows is ignored.

MS SQL Server should watch out for # or its hex equivalent.

Hex equivalent of – does not count because it is not a HTML meta character, so %2D fails

will be continued…

polonus