Please send
comments/questions to
michael@
teratech.com

Page Validation

• URL and Form parameters used in SQL

  • SELECT * FROM EMP WHERE ID = #USERID#
  • Extra SQL commands on SQL Server
    http://myserver/page.cfm?ID_VAR=7%3BDELETE%20FROM%20MyCustomerTable
  • | VBA functions - shell() on Access
  • xp_cmdshell in SQL Server

• Use VAL() on parameters or check for ‘ and | or use <CFQUERYPARAM>

• Encrypt Variables

• Checksum URLs

Previous slide

Next slide

Back to first slide

View graphic version