Let us continue our postings about the use of regular expressions and security.
For a good background read go here: http://www.softpanorama.org/Scripting/Javascript/javascript_regular_expressions.shtml
link article info - Copyright © 1996-2015 by Dr. Nikolai Bezroukov.
…continued: /((%3D)|(=)) the equals sign “=” or its URL-encoded equivalents/variants.
[^ \n]* zero or more non-newline characters.
((%27 | (')| single quote double dah.
(--) | (%3B) | (;)) or semi-colon or their URL-encoded versions.
SQL Keyword ‘or’ attack, regular expression to detect attack:
/ \w*((%27)| (')) (\s | + | %20)* (%6F) | (%4F)) ((%72)|/) (%52))/ix
\w* zero or more alphanumeric or underscore characters
(\s | + | %20)* zero or more whitespaces or their HTTP-encoded equivalents
((%27)| (')) the singkle quote or its HEX-equivalent.
(%6F) | (%4F)) the word ‘or’ with combinations of its upper case or lower case.
((%72)|/) (%52)) or lower case.
UNION keyword attack used by attackers to combine a select statement into a single result set
(note the difference between set and list - my note - pol).
/ ((%27)|(')) (select | union | insert | update | delete | replace | ix SQL-Keuwords.
(%27)|(') the single quote and its hex-equivalents.
will be continued on “dangerous procedures start etc”.
polonus (volunteer website security analyst and website error-hunter)
P.S. The use of regular expressions for data validation can be followed here: http://wenku.baidu.com/view/88e25d4d2e3f5727a5e962d0.html
I use the Google Translator Tooltip Extended Script via Tampermonkey to translate the Chinese instructions
from that website on the fly.
达米安 Damian