Web Wiz Support and Community Forums : SQL code visible in page? https://forums.webwiz.net/ Copyright (c) 2006-2013 Web Wiz Forums - All Rights Reserved. Tue, 07 Apr 2026 14:55:33 +0000 Sun, 13 May 2007 21:31:55 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 12.08 360 https://forums.webwiz.net/RSS_post_feed.asp?TID=23313 <![CDATA[Web Wiz Support and Community Forums]]> https://forums.webwiz.net/forum_images/web_wiz_forums.png https://forums.webwiz.net/ <![CDATA[SQL code visible in page? : The best thing to do is to findout...]]> https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122765.html#122765 Author: WebWiz-Bruce
Subject: 23313
Posted: 13 May 2007 at 9:31pm

The best thing to do is to findout exactly the code the person is using then use the contact us section of this site to contact support with the details of how they are doing this, we will then beable to advise you how to prevent this from happening.]]> Sun, 13 May 2007 21:31:55 +0000 https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122765.html#122765 <![CDATA[SQL code visible in page? : Thats correct, but we did minimal...]]> https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122763.html#122763 Author: craigr
Subject: 23313
Posted: 13 May 2007 at 8:59pm

Thats correct, but we did minimal code changes - as we didn't want to break the security.
 
Can you give me some further pointers on the SQL hack please? eg how I can test it. PM if necessary please
 
Cheers
Craig
]]> Sun, 13 May 2007 20:59:23 +0000 https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122763.html#122763 <![CDATA[SQL code visible in page? : Your login page looks like it&#039;s...]]> https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122762.html#122762 Author: WebWiz-Bruce
Subject: 23313
Posted: 13 May 2007 at 8:48pm

Your login page looks like it's been modified to use the users email address instead of the username to login.

This would mean that the query your user is seeing to login is something which is not part of the original code and the user is probably using an SQL Injection to make the forum crash and display the SQL Query.

Web Wiz Forums does come with built in protection against SQL Injections, but if you have modified the code you may have accidentally removed the code that protects against SQL Injections from this query used to login users.
]]> Sun, 13 May 2007 20:48:12 +0000 https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122762.html#122762 <![CDATA[SQL code visible in page? : Thanks Borg. Thats good to know....]]> https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122761.html#122761 Author: craigr
Subject: 23313
Posted: 13 May 2007 at 8:19pm

Thanks Borg. Thats good to know.
 
However the (disgruntled) user has posted the first query in the login function in its entirety. eg select username...where handle = "" etc.
 
I'm currently trying to get him to let me know how he is doing it and if it's the only one he sees. Once I have his feedback I'll post what he is doing.
 
Cheers
Craig
]]> Sun, 13 May 2007 20:19:03 +0000 https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122761.html#122761 <![CDATA[SQL code visible in page? : The connection code will not be...]]> https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122758.html#122758 Author: WebWiz-Bruce
Subject: 23313
Posted: 13 May 2007 at 7:02pm

The connection code will not be displayed.

If there is a problem connecting to the SQL server, they may see an error like:-

Problem connecting to database xxx using username xxx

But this doesn't revel your password and is an error coursed by the server, not the software, the only way to prevent such error messages is to disable detailed ASP error messages in the web server itself, but this can course difficulties in debugging any issues you may have running ASP on your site.
]]> Sun, 13 May 2007 19:02:05 +0000 https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122758.html#122758 <![CDATA[SQL code visible in page? : Hi I have just been notified...]]> https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122736.html#122736 Author: craigr
Subject: 23313
Posted: 13 May 2007 at 3:31am

Hi
 
I have just been notified by one of our more IT savvy users that the login SQL string is visible when they login. The address is www.fishing.net.nz/asp_forums/.
 
I've viewed the code and I cannot see it. Is there some debuging mode or way the SQL code can be captured & displayed?
 
Thanks is advance.
Craig
]]> Sun, 13 May 2007 03:31:19 +0000 https://forums.webwiz.net/sql-code-visible-in-page_topic23313_post122736.html#122736