Form field security

[riffraff-2O2uHw]

I have a highly controversial website that has been gathering information for a class action against a top 5 US bank. Recently their has been multiple and systematic attempts to access my database using sql commands submitted through various form fields. These attempts and the results they might produce are above my scope of knowledge and I am requesting assistance in how to thwart these attacks and what info it may have revealed.

The attacks submit sql code through form fields in blobks of 8 and 16 attempts simultaneously. Here is an example of what is being submitted:

1 declare @q varchar(8000) select @q = 0x574149544

I have created a list of keywords (declare, varchar, etc) that will trigger a cfabort but this is placed after an insert statement to capture what was submitted.

Any insight would be greatly appreciated.

[Stressed_Simon]

Use cfqueryparam and then you are locked up as tight as a drum!

[riffraff-2O2uHw]

Interseting read on cfqueryparam, thanks. Can anyone tell me what [1 declare @q varchar(8000) select @q = 0x574149544] does and what results it may have yeilded?

[riffraff-2O2uHw]

The latest submit attempt contained the following:

[*map/map_all_ag2.txt||10||r||1|| @]

Does anyone have any insight on this or the previous code as to what the user was able to access?

[Guest]

You could try entering the values in your form fields to see what's displayed. Of course, do this on a duplicate test system.

Hackers are creative and not having a job can give you lots of time to make peoples lives lousy.