Five Tips for Thwarting Data Input Attacks Against Your Web App  : Page 5

Tip 4—Check the Values Returned from the SQL Query
One way to mitigate these attacks completely is to stop using count(*) as the "thumbs up, thumbs down." Instead, check the username and password against the username and password returned by the SQL query. The syntax looks like this:

var strSQL = "SELECT name, pwd FROM client WHERE " +
		"(name='" + strName + "') " + 
		" and " +
		"(pwd='" + strPwd + "')";
var oRS = new ActiveXObject("ADODB.RecordSet");
oRS.Open(strSQL,oConn);
fAllowLogon = (oRS(0).Value == strName && oRS(1).Value == strPwd)
 ? true : false;

If the SQL query returns no data, an exception is generated and then caught by the catch() body.

Previous Page

Next Page