CFLib.org – Common Function Library Project

IsSQLInject(input)

Last updated July 1, 2002
Download UDF

author

Will Vautrain                                     Will Vautrain

Version: 1 | Requires: ColdFusion 5 | Library: DatabaseLib

 
Rated 7 time(s). Average Rating: 2.4

Description:
This security-related function is intended to test for strings that users intentionally or otherwise may pass in form fields that may cause SQL injection to occur. SQL injection is an event in which a malicious or unknowing user inserts arbitrary SQL statements into queries without the knowledge of the programmer. This UDF mainly relates to those using SQLServer, I am not sure if the test I use protects against the same vulnerabilities on other database platforms.

Return Values:
Returns a boolean.

Example:

<cfset sqlString1 = "Chicken soup with rice">
<cfset sqlString2 = "Chicken soup with' drop table soups--">

<cfoutput>
sqlString1 = #sqlString1# IsSQLInject? #IsSQLInject(sqlString1)#<br>
sqlString2 = #sqlString2# IsSQLInject? #IsSQLInject(sqlString2)#<br>
</cfoutput>

Parameters:

Name Description Required
input String to check. Yes

Full UDF Source:

<cfscript>
/**
 * Tests a string, one-dimensional array, or simple struct for possible SQL injection.
 * 
 * @param input 	 String to check. (Required)
 * @return Returns a boolean. 
 * @author Will Vautrain (&#118;&#97;&#117;&#116;&#114;&#97;&#105;&#110;&#64;&#121;&#97;&#104;&#111;&#111;&#46;&#99;&#111;&#109;) 
 * @version 1, July 1, 2002 
 */
function IsSQLInject(input) {
	/*
	* The SQL-injection strings were used at the suggestion of Chris Anley [chris@ngssoftware.com]
	* in his paper "Advanced SQL Injection In SQL Server Applications" available for downloat at
	* http://www.ngssoftware.com/
	*/
	var listSQLInject = "select,insert,update,delete,drop,--,'";
	var arraySQLInject = ListToArray(listSQLInject);
	var i = 1;
	
	for(i=1; i lte arrayLen(arraySQLInject); i=i+1) {
		if(findNoCase(arraySQLInject[i], input)) return true;
	}
	
	return false;
}
</cfscript>

Search CFLib.org


Latest Additions

John Bartlett John Bartlett added
browserDetect
5 day(s) ago

Rob Brooks-Bilson Rob Brooks-Bilson added
listCompare
8 day(s) ago

Stephen Withington Stephen Withington added
formToNameValueP...
16 day(s) ago

anthony petruzzi anthony petruzzi added
parseExcel
21 day(s) ago

Pablo Varando Pablo Varando added
returnRandomHEXC...
22 day(s) ago

Top Rated

Nathan Dintenfass                                 QueryStringChang...
Rated 5.0, 10 time(s)

Stephen Withington formToNameValueP...
Rated 5.0, 5 time(s)

Gyrus                                             HTMLSafe
Rated 5.0, 4 time(s)

Shlomy Gantz                                      viewCSS
Rated 5.0, 4 time(s)

Michael Sharman generateRandomKe...
Rated 5.0, 3 time(s)

Created by Raymond Camden / Design by Justin Johnson