Developer's Guide to Web Application Security

■

A semicolon (used in SQL to separate statements)

■

A known SQL command

■

Any additional text

This will find a second SQL statement embedded in a variable. In MS-SQL, this

second statement can be made to run, which can cause a result other than expected.

This is not foolproof code, because it looks only for the four major SQL statements.

Stored procedures or other code can still be run.

Risks Associated with Using ColdFusion

In the sixth century, Pope Gregory the Great deemed that sloth is a deadly sin—this

is more than true in programming! The number of ColdFusion and other sites that

have been attacked is so large for the simple reason that administrator ...