I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008. It doesn't really look like it, but I'm wondering exactly what code I can get past it to prove it doesn't protect.
value = Regex.Replace(userInput, "[\n\r\t\']", " "); sqlCmd = "Select names from mytable where mycolumn like '%" + value + %'"; SQLDataAdapter results = new SQLDataAdapter(sqlCmd, connString);
Now, I've figured out that if I can get a single quote past, I can do something like
a' union all select passwords as names from myusertable;--
The problem is, the regex does catch the single quote, and I haven't a clue how to escape/encode/ect. it to get it past the regex. I've been looking for something, but everything seems to assume that you can get a single quote past. Obviously it can't be that simple to stop all sql injection attacks, but I personally don't know what to put to get past it. Any help?
To be a bit more specific, I've heard that one can use unicode characters to slip a single quote past a check in many languages as there are unicode characters that are treated as such by the programming language, but when they get to the database, they are just treated as a quote. But I've found nothing but theory on this. When I try to explain it, it sounds like 'Well, people think this could happen, but it has never been shown to actually be a vulnerability' and that doesn't convince the senior individual who programmed this.