SQL injection is good

Question

I have done a lot of research on this, but I still have a problem understanding this. However, I want to make sure that I am properly protected. I wrote a function in classic ASP to help prevent SQL injection or possible brute force for the database. Could you guys give me your own input and suggestions if I need to add to it or delete something or even fix problems to make it more secure? Thank you in advance!

I use this below right before pasting into a MySQL database.

Insert example:

conn.execute("INSERT INTO " & employees & "(eid, first_name, last_name) VALUES('" & Clng(strEID) & "','" & SQLClean(strfirstname) & "','" & SQLClean(strlastname) & "');") 

Function:

 Private Function SQLClean(ByVal strString) If strString <> "" Then strString = Trim(strString) 'Remove malisous charcters from sql\ strString = replace(strString,"-shutdown","", 1, -1, 1) strString = replace(strString,"\","\\", 1, -1, 1) strString = replace(strString,"=","\=", 1, -1, 1) strString = replace(strString,",","\,", 1, -1, 1) strString = replace(strString,"`","\`", 1, -1, 1) strString = replace(strString,"&","\&", 1, -1, 1) strString = replace(strString,"/","\/", 1, -1, 1) strString = replace(strString,"[","\[", 1, -1, 1) strString = replace(strString,"]","\]", 1, -1, 1) strString = replace(strString,"{","\{", 1, -1, 1) strString = replace(strString,"}","\}", 1, -1, 1) strString = replace(strString,"(","\(", 1, -1, 1) strString = replace(strString,")","\)", 1, -1, 1) strString = replace(strString,";","\;", 1, -1, 1) strString = replace(strString,"+","\+", 1, -1, 1) strString = replace(strString,"<","\<", 1, -1, 1) strString = replace(strString,">","\>", 1, -1, 1) strString = replace(strString,"^","\^", 1, -1, 1) strString = replace(strString,"@","\@", 1, -1, 1) strString = replace(strString,"$","\$", 1, -1, 1) strString = replace(strString,"%","\%", 1, -1, 1) strString = replace(strString,"!","\!", 1, -1, 1) strString = replace(strString,"*","\*", 1, -1, 1) strString = replace(strString,"~","\~", 1, -1, 1) strString = replace(strString,"#","\#", 1, -1, 1) strString = replace(strString,"?","\?", 1, -1, 1) strString = replace(strString,"'","\'", 1, -1, 1) strString = replace(strString,"""","\""", 1, -1, 1) strString = replace(strString,"select","\select", 1, -1, 1) strString = replace(strString,"insert","\insert", 1, -1, 1) strString = replace(strString,"update","\update", 1, -1, 1) strString = replace(strString,"delete","\delete", 1, -1, 1) strString = replace(strString," or "," \or ", 1, -1, 1) strString = replace(strString," and "," \and ", 1, -1, 1) strString = replace(strString,"drop","\drop", 1, -1, 1) strString = replace(strString,"union","\union", 1, -1, 1) strString = replace(strString,"into","\into", 1, -1, 1) 'Return cleaned value. SQLClean = Trim(strString) End If End Function 

Answer 1

Please DO NOT FIND under any circumstances try to write your own SQL escaping code if this is not a purely academic exercise. You will be mistaken. If someone uses the SQL injection tool on your site, you will have serious consequences. Business and career have been destroyed by people who casually approach it.

It took me only three minutes to find fooobar.com/questions/1432409 / ... telling about Classic ASP and MySQL queries using parameters.

Please, please, please use official services and do not collapse your own.

Answer 2

Here's a good read link to prevent SQL Injection intrusions in ASP Classic scripts.

It is also worth noting that you should always check your variables by checking the correct values ​​before resetting them in the SQL query. Checking the correct values ​​is usually simpler than checking all the possible bad things that people can insert into variables.