User-1481068292 posted
We HAD the problem as well, and have been using parameterized queries. We took several steps and seem to have stopped the problem.
1.) Adjust your DB security to the absolute minimum required to get the job done. Separate your website logins for everything else AND separate the logins between Select only and Insert/Update/Delete.
2.) Validate every piece of data including simple integers (make sure they are numbers).
3.) Use stored procs where you can or even updatable views with instead-of triggers.
4.) Look for Injection, we use the following to prep every character entry, AND we ALWAYS hard type numerics.
Here is the code we use to help trap injection you can adjust as you need
'Checks for possible injection during validation
Function IsSQLInjection(strValue)
dim retVal
dim arrKeywords
dim Keyword
arrKeywords = Array("--",";","/*","*/","sysobjects","syscolumns","<script","xp_","sp_"," insert "," update "," delete "," cast"," nvchar")
retVal = false
For Each Keyword in arrKeywords
If instr(strValue,Keyword) <> 0 Then
retVal = true
Exit for
End if
Next
IsSQLInjection = retVal
End Function
'SQLEscape (preps all char input)
Private Function SQLEscape(strValue)
Dim retVal
retVal = strValue
'Response.Write "SQLEscape| strValue: " & strValue & "<br>" 'debug
If not IsNull(retVal) Then
if len(retVal) = 0 then
retVal = "NULL"
else
retVal = "'" & Replace(strValue, "'", "''") & "'"
retVal = StopInjection(retVal)
end if
End if
'Response.Write "SQLEscape| retVal: " & retVal & "<br>" 'debug
SQLEscape = retVal
End function
Function StopInjection(strValue)
dim retVal
dim arrKeywords
dim Keyword
arrKeywords = Array("--",";","/*","*/","sysobjects","syscolumns","<script","xp_","sp_"," insert "," update "," delete "," cast"," nvchar")
retVal = strValue
For Each Keyword in arrKeywords
retVal = replace(retVal,Keyword,"")
Next
StopInjection = retVal
End Function
Hope this helps. It has helped us. We also added a honey-pot table in the database; big wide varchar column with update open to any security level to make sure that it is not just the tightening of the database security that has stopped the attacks.
So far knock on wood. The next step will be a Web Secuirity Appliance or plug-in like dotDefender from Applicure (they also have a free monitor so you can see the attacks).
