REPLACE COMMAND
REGULAR EXPRESSION
REGEX
for insertion of a function in a existing request input, to avoid sqlinjection vulnerabilities.
2. <%=Request(.[a-z0-9_"()]+)%> <%=rem_culp_char\((Request\1)\)%>
2. =trim\(Request(.[a-z0-9_"()]+)\) =trim\(rem_culp_char\((Request\1)\)\)
3. =Request(.[a-z0-9_"()]+) =rem_culp_char\((Request\1)\)
4. SINGLE SPACE Request.form(.[a-z0-9_"()]+) SINGLE SPACE rem_culp_char\((Request.form\1)\)
5. SINGLE SPACE Request(.[a-z0-9_"()]+) SINGLE SPACE rem_culp_char\((Request\1)\)
inital space at item 4 & 5 in both search replace
function rem_culp_char(strWords)
dim newChars, i
newChars = strWords
If len(newChars) > 0 Then
newChars= replace(newChars, "select", "s-e-l-e-c-t",1,-1,1)
newChars= replace(newChars, "script", "s-c-r-i-p-t",1,-1,1)
newChars= replace(newChars, "insert", "i-n-s-e-r-t",1,-1,1)
newChars= replace(newChars, "drop", "d-r-o-p",1,-1,1)
newChars= replace(newChars, "delete", "d-e-l-e-t-e",1,-1,1)
newChars= replace(newChars, "xp_", "x-p_",1,-1,1)
newChars= replace(newChars, "<", " [Less than] ")
newChars= replace(newChars, ">", " [Greater than] ")
newChars= replace(newChars, "'", " [Single Quote] ")
newChars= replace(newChars, "(", "[")
newChars= replace(newChars, ")", "]")
newChars= replace(newChars, ";", ",")
newChars= replace(newChars, "=", " Equal To ")
newChars= replace(newChars, "--", "...")
newChars= replace(newChars, "|", " [PipeChar] ")
newChars= replace(newChars, "\", " [backslash] ")
rem_culp_char=newChars
End If
end function
