Prevent SQL injection by using IIS URL Rewrite

Posted on June 23, 2010 by Mick Genie

Nowaday, a bad or unoptimizes SQL query could easily compromised or get attacked. However you may try to reduce or prevent (Don't say avoid, it is not possible, keke) the SQL injection through your expression rules.

If you are using IIS as your web engine, you may use some expression to reduce the SQL injection.

PLAIN TEXT
CODE:
  1. [dD][\%]*[eE][\%]*[cC][\%]*[lL][\%]*[aA][\%]*[rR][\%]*[eE][\s\S]*[@][a-zA-Z0-9_]+[\s\S]*[nN]*[\%]*[vV][\%]*[aA][\%]*[rR][\%]*[cC][\%]*[hH][\%]*[aA][\%]*[rR][\s\S]*[eE][\%]*[xX][\%]*[eE][\%]*[cC][\s\S]*

So the full web.config file will be look as below.

PLAIN TEXT
CODE:
  1. ‹?xml version="1.0" encoding="UTF-8"?›
  2. ‹configuration›
  3. ‹system.webServer›
  4. ‹rewrite›
  5. ‹rules›
  6. ‹rule name="Filter SQL injection" stopProcessing="true"›
  7. ‹match url=".*" /›
  8. ‹conditions›
  9. ‹add input="{REQUEST_URI}" pattern="[dD][\%]*[eE][\%]*[cC][\%]*[lL][\%]*[aA][\%]*[rR][\%]*[eE][\s\S]*[@][a-zA-Z0-9_]+[\s\S]*[nN]*[\%]*[vV][\%]*[aA][\%]*[rR][\%]*[cC][\%]*[hH][\%]*[aA][\%]*[rR][\s\S]*[eE][\%]*[xX][\%]*[eE][\%]*[cC][\s\S]*" /›
  10. ‹/conditions›
  11. ‹action type="AbortRequest" /›
  12. ‹/rule›
  13. ‹/rules›
  14. ‹/rewrite›
  15. ‹/system.webServer›
  16. ‹/configuration›

Popularity: 55%

Related posts:

  1. URL Rewrite with IIS 7.x
  2. Enabling Permalink from WordPress with IIS7.x
  3. Joomla Search Engine Friendly(URL) in IIS7
  4. Classic ASP script error messages are no longer shown in a Web browser by default
  5. Ruby on Rails Handy Guide
This entry was posted in Microsoft IIS and tagged , , , , , , , , , , , , , , , , , , , , , . Bookmark the permalink.
blog comments powered by Disqus