2
Function RemoveSuspeitos(ByVal strTXT)
               Dim txtAux As String
               txtAux = strTXT
               txtAux = Replace(txtAux, chr(34), "")
               txtAux = Replace(txtAux, "'", "")
               RemoveSuspeitos = txtAux
End Function

DB: MSSQL

1) Forget syntax errors in the above code, I am not expert in VB.

2) Lets say I always use single or double quotes, even for int values (e.g.: '" + $int_id + "').

Is this sanitization unsafe? If yes, why? Please show me a real exploit scenario.

4
  • Well right off the bat I can see "delet" is spelled incorrectly so the actual "delete" keyword will never be replaced.
    – ilikebeets
    Apr 17, 2014 at 5:22
  • Also, I'm no VB expert, but I'm pretty sure txtAux = Replace(txtAux, "%22", "") '" will result in compilation errors.
    – ilikebeets
    Apr 17, 2014 at 5:32
  • Same question on Stack Overflow.
    – Gumbo
    Apr 17, 2014 at 5:54
  • 1
    SQL smuggling may be an issue here.
    – Gumbo
    Apr 17, 2014 at 5:56

1 Answer 1

3

Yes it is vulnerable. Depending on the input mechanism and the implementation I can simply append a UNION and continue the query to select additional data. I cannot give you an exact scenario without seeing the implementation and the query this string is concatenated with. Fact is that you allow input beyond the scope you will need or want.

Just use parameterized SQL, I'm sure VB supports adding parameters to your queries.

See this

2
  • What about escaping from the quoted string literal?
    – Gumbo
    Apr 17, 2014 at 7:36
  • 1
    +1 for "just use parameterized SQL". A security-best practices tl;dr for every developer right there if ever you needed one.
    – Matt
    Apr 17, 2014 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .