# Is Taking advantage of the IsNumeric() Function In VB.Net Through SQL Injection Possible?

Suppose this is the only mitigation used on a server:

``````Dim IDPerson
IDPerson = Request.Querystring("id")
If IsNumeric(IDPerson) = True Then
IDPerson = IDPerson
Else
IDPerson = 0
End If
``````

IDPerson is then used to write the query. The "id" is the GET variable.

I know IsNumeric will accept Hex as numeric.

Could a whole query be constructed in hex and pass the IsNumeric function?

-
always wanted to know about that. i also do some stuff all the time to make sure the db isn't even touched. – user24408 May 29 '13 at 22:34

I'm gonna say that it depends on what you do later with the ID variable. If your code later converts the hex to a string and then builds queries with it, then the answer becomes 'yes'

Example:

I build an e-commerce website that looks looks up your purchase history based on your customer ID... Being a noob, I came up with a clever idea of using your email address to generate your ID by simply converting it to hexadecimal.

• my email = `customer@example.com`
• my ID would then be = 637573746f6d6572406578616d706c652e636f6d

That looks like a "pretty secure" and unique ID, so I feel really good about what I've done.

Now the injection:

Someone figures out that the user ID is simply the hex equivalent of the email address and guesses that I may be converting it back into text and using that result in a query

http://mysite.com/orderhistory?userid=637573746f6d6572406578616d706c652e636f6d

• injected ID = 31272064726f70207461626c652075736572733b202d2d

• ascii equivalent = `1' drop table users; --`

If I, the developer, check to make sure the ID is numeric... then hex-to-text the ID... then use it in a query.... I've just allowed a sql injection

References:

Here's a similar question regarding SQL injections using only alpha-numeric characters: http://stackoverflow.com/questions/8086906/keeping-clear-of-sql-injections

Here's another thread discussing sql injection via hex: http://arstechnica.com/civis/viewtopic.php?f=20&t=107657

... Of course the right solution is to use 'real' prevention mechanisms such as parameterized queries, but this is certainly an interesting question.

-
I'm still not seeing an example anywhere of a complete query in Hex. It seems people only splash Hex in. – k to the z May 31 '13 at 17:36
I added an example of how a developer gone wrong could allow the injection – BrianAdkins May 31 '13 at 20:55