The Access Database is held below the root of the site meaning it cannot be easily downloaded.

 

I have just noticed that the site has been hacked by 'DP Hack Team' / 'Hakan'. The only change to the site was a new entry in the database which had code to hide the entry so that it did not appear on the site but was trying to install some active-x content in the clients browser when they accessed my site.

 

I have scanned the server and cannot find any other files that have been created.

 

The question is, the security of the database editing pages is using a simple login form and then checking the results in an ASP page. If the admin is validated then a session variable is set and access to the admin pages is granted. Each admin page checks the status of the session variable before doing anything else.

 

Could this method be hacked through the use of session variables, or is it more likely that access came some other way such as a dictionary attack on the login page?

 

I have used the above method quite a few times on different sites so I'm concerned that I'm not aware of some issue.

 

Any advice for securing your ASP pages (shared host environment).

 

Regards

 

Is it as simple as ensuring that semicolon cannot be passed in and end up in the SQL string? Do I need to worry about other representations of the character?

 

A typical SQL might be

 

"SELECT stuff FROM mytable WHERE ID=" & strID & ";"

 

and strID might have been passed in the URL.

 

Ta