FAQ

What is SQL Inject?

SQL inject is a way to communicate with a database through a loophole in a website in a way that the web developer did not intend to. In the dawn of internet, you always had multiple static html-files for each webpage - Today it's very common to use one or a few pages that collects information from a database and displays it to the user. To do this - the server needs to know what information is requested. One example is this:

dim strSQL
strSQL = "SELECT pageTitle, pageText, pageAuthor FROM pages WHERE ID = " & Request.Querystring("ID")

So when a user browse to the page containing the code above with the querystring value of "?ID=123" - the SQL server would read it like this:
SELECT pageTitle, pageText, pageAuthor FROM pages WHERE ID = 123
Now - suppose that someone writes something else after the "123" in our example above - then that text would also be sent to the SQL server.
If you enter a semicolon (;) after "123" - SQL server will think that means that whatever comes after the semicolon is a new command. So if you write:

?ID=123; DROP pages

- SQL server will read it as:

SELECT pageTitle, pageText, pageAuthor FROM pages WHERE ID = 123
DROP pages

So SQL server will execute the original query - but then delete the whole table from the database.
Adding "--" on the end will tell SQL server that whatever comes after should be ignored - this is used by hackers to ensure that an error will not occur after the injected code. (In the example above - you wouldn't need to add "--")
As you can see - it's an easy way to ruin a website - or in some cases - even take control over it.

How does SecureRequest Protect me?

Securerequest works by replacing the original requestobject. Securerequest allows you to ban and or replace patterns in the request object. These patterns can be defined by literal values or by regular expressions.

Do I need to replace all my "Request" calls to "SecureRequest"?

No! And that is the beauty of it - SecureRequest replaces the native Request object so all of your code will still work as usual. The only thing needed is two lines of code or an include file at the top of your pages - but you don't even need to do that on your own - The SecureRequest configurator can do it for you!

Does SecureRequest secure all the collections in the Request object?

Yes! SecureRequest has all the original methods and collections implemented:
Request(Item)
Secured Collections:
Request.Form
Request.Querystring
Request.ServerVariables
Request.Cookies*
Request.ClientCertificate**
Request.TotalBytes**
Request.BinaryRead**

However, if you don't feel the need to secure all of the collections - you have the possibility to turn it off. For example, if you don't send any values from user cookies to the SQL server you can use the setting: DontFilterCookies = true

I need to have unedited data from the request object, is it possible?

Of course! by using the disableFilter() and the enableFilter() methods you can still read from the original request object.
Example:

str = Request.form("name") ' Secured data
Request.disableFilter() ' Disable SecureRequest
unsecureStr = Request.form("name") ' Unsecure data
Request.enableFilter() ' Enable SecureRequest again
secureStr = Request.form("name") ' Secured data