"A perfectly natural human response to this message is to
retreat and patch the software to stop that SQL syntax from being
injected into the Web application. The developers are likely to
write some logic that goes like: if (SQL syntax is present in an
input) disallow the input.
"Then, the pen test is repeated, the problem is resolved, and
everyone is happy. Right? Wrong.
"The problem with this approach is that it is almost always a
negative model, not a positive one. That is, the programmers will
naturally be drawn to checking a “blacklist” of banned
SQL syntax, and then disallowing the input. This type of negative
validation can invariably be broken by a determined adversary."
Some of the products that appear on this site are from companies from which QuinStreet receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. QuinStreet does not include all companies or all types of products available in the marketplace.