NoSQLInjection Function:
Protection against an SQL Injection attempt.
Description:
The NoSQLInjection function holds an array of illegal characters and words, it loops through these checking for their presence in the input string using the InStr function.
If any are present in the input string then NoSQLInjection returns False.
Syntax:
boolean = NoSQLInjection(strInput)
Example:
<%
Dim sUsername, sPassword
'--- retrieve our form textbox values and assign to variables
sUsername=Request.Form("txtUsername")
sPassword=Request.Form("txtPassword")
'--- Call the function NoSQLInjection to check for illegal characters
If NoSQLInjection(sUsername) = True OR NoSQLInjection(sPassword) = True Then
Response.redirect("access_denied.asp")
End If
%>
ASP Source Code:
<%
Private Function NoSQLInjection(byVal strInput)
Dim sBadChars, bTemp, i
'--- Disallowed characters and words
sBadChars=array("select", "drop", "insert", "delete", "update", "xp_", _
"char", "nchar", "varchar", "nvarchar","declare", "end", "exec",_
"alter", "begin", "cast", "create", "cursor","execute", "open",_
"table", "sys", "sysobjects", "syscolumns", "fetch", "kill",_
"--", "..", "{", "}", "[", "]", "<", ">", "(", ")", "#", "%", "&", "'", "`", _
"/", "\", ":", ";", "=", "?", "|", "$", "*", "!", "^", " ")
for i= 0 to uBound(sBadChars)
If Instr(strInput, sBadChars(i)) > 0 Then bTemp = True
if bTemp then Exit For
next
for i = 1 to Len(strInput)
if Asc(Mid(strInput, i, 1)) = 160 then bTemp = True
if bTemp then Exit For
next
if Not bTemp then '--- Addition for leading and trailing spaces
bTemp = (len(strInput) <> len(Trim(strInput)))
end if
'--- if any of the above are true, the string is invalid
NoSQLInjection = Not bTemp
End Function '--- NoSQLInjection
%>
|
