Cross site scripting and SQL injection

we have developed application in coldfusion 6.1 . have found our application vulnerable cross site scipting , sql injection. can 1 me out solve problem .

 

and suggest if need install hotfixes or component available .

coldfusion has built-in defence against cross-site scripting , injection attacks. scriptprotect attribute of cfapplication tag. however, included coldfusion mx7.x onwards. have thought migrating coldfusion 8? many other benefits besides.

 

luckily, there handy device against cross-site scripting , injection attacks, namely, cfqueryparam tag.  present in mx 6.1.

 

sql injection happens user data enters query. so, have extended search queries in application. identify form variables , url variables enter queries.

 

do validation variables before query. example, simple test numbers using isnumeric() may that  required. if value fails validation, reject it, throw exception, , abort.

 

use cfqueryparam in each case enter form , url variables query. beware of variables in other scopes, such session.userid, entered application form or url variables. have sanitized using cfqueryparam.

 

last but, certainly, not least, psychological part of defence. remember there @ other end, trying cause mischief application. might customer, colleague or acquaintance of yours, or ex-customer or ex-colleague. realize in same building or in same room you.

 

take war them. try identify ip addresses. clues , patterns in attacker's behaviour. frequency, times of day, parts of application attacked, , on. study data attacker enters. attackers carried away , unintentionally leak out details themselves.

 

build dossier. in countries, in western countries, cross-site scripting , injection attacks, particularly concerted attacks, count crime  nowadays.

More discussions in ColdFusion

adobe