A problem to guard against SQL injection attacks _ network security

At present, many IIS firewalls are essentially an ISAPI filter, and the essence of the defense of SQL injection attacks is keyword filtering, as mentioned in my previous essays in the development of Web Server guard. However, most of the IIS firewalls currently have a vulnerability: If the keyword contains an escaped percent sign (%), the request filtering and blocking of these IIS firewalls will be bypassed, containing the requests filter for IIS 7.0.

Because these firewalls are all looking for keywords that are located in Url/form/cookie, such as exec. But if you pass in the e%xec, then will not be filtered, this problem in the current well-known IIS firewall (not specifically introduced, so as to avoid advertising suspicion, Google search can know) exist, it is easy to easily penetrate. This problem also exists within a set of security filtering functions that Microsoft provides for ASP.

URLScan also has this problem, but URLScan 3.0beta I haven't tested yet. So you should be aware of this in developing ISAPI Request filter.

Http://www.ietf.org/rfc/rfc2396.txt

IIS 7.0 Patch:

Http://www.microsoft.com/downloads/details.aspx?FamilyID=9bf0adf3-20ce-4772-8304-83b68983c1fa&DisplayLang=zh-cn

Http://support.microsoft.com/kb/957508/en-us