Form Validator “Hasta La Vista SQL Injection”

Their Job, Our Job, It’s Job Chris Anley mentions Four Best- Practices to Avoid SQL Injection Chris Anley mentions Four Best- Practices to Avoid SQL Injection –Three are Sys. Admin and DBA tasks –Only one is related exclusively to coding –Comprehensive Input Validation That’s what the Form Validator does! That’s what the Form Validator does!

You’re Not Saying…?!? No, this is NOT the silver bullet for security or even just SQL Injection. No, this is NOT the silver bullet for security or even just SQL Injection. Comprehensive Input Validation Comprehensive Input Validation –“Comprehensive” now may not be tomorrow. –Your “Comprehensive” may be more than mine. We need a foundation on which to build. We need a foundation on which to build.

Another “Perfectly Conceived” Acronym FDF originally stood for Form DeFinition FDF originally stood for Form DeFinition –Hideously Stupid Could stand for Form Definition File Could stand for Form Definition File –I Like this One Whatever you call it, here lies the building blocks of the Form Validator - XML Whatever you call it, here lies the building blocks of the Form Validator - XML

Form Definition File Built on XML Built on XML Makes use of a set of pre-defined tags to create rules for a form and elements on that form. Makes use of a set of pre-defined tags to create rules for a form and elements on that form. Each FDF file (after the ?XML tag) begins with the fdf tag. Each FDF file (after the ?XML tag) begins with the fdf tag. Structure of all of the tags under fdf… Structure of all of the tags under fdf…

From to From to fdf fdf –form –return –group (optional) id id required required total total –rule (optional groupid = “ ”) display display field field length length type type required required

Elements Explained… form form –Describes the name of the form which the validator is validating. –XML syntax – “ … ” return return –Describes the URL of the page which contains the above form. –XML syntax – “ … ”

Grouped Fields Need an “Outta”? Need an “Outta”? group group –Contains the information for a particular set of grouped fields. –XML syntax <group><id>…</id><required>…</required><total>…</total></group> Optional “groupid” Attribute Optional “groupid” Attribute

Form Validator – Ruler of the Form The individual rules for each form element. The individual rules for each form element. rule rule –Contains the information for a particular form field. –XML syntax <rule> … … </rule>

Grouped By Group ID The “groupid” attribute can be given to a rule to associate it to a group of rules. The “groupid” attribute can be given to a rule to associate it to a group of rules. For example For example<group><id>…</id></group> …</rule>

Stick Together and We’ll Make It Through All … tags must be together before all … tags. All … tags must be together before all … tags. The format is The format is<group>…</group><group>…</group><rule>…</rule><rule>…</rule><rule>…</rule>

Sample FDF <fdf><form>frmSave</form><return>index.cfm?subap=Lubay&action=EditItem&ItemID=#ItemID#</return><group> group1 group </group> Title Title txtItemName txtItemName Char Char 1 1 </rule> Description Description txtDescription txtDescription Char Char 1 1 </rule><rule> Name Name txtName txtName Char Char 0 0 </rule></fdf>

Pause for Effect Normal Form System Methodology Normal Form System Methodology Form PostedSQL Generated SQL Run on DB

Pause for Effect Form Validator System Form Validator System Form PostedSQL GeneratedSQL Run on DBChecked Against FDF All you have to do is plug in the Form Validator. All you have to do is plug in the Form Validator.

How to “Plug It In” Find the file to which a form is posted Find the file to which a form is posted Before ANY action is taken with that data (i.e. it is dynamically placed in a SQL query) call the Form Validator Before ANY action is taken with that data (i.e. it is dynamically placed in a SQL query) call the Form Validator Example Call Example Call If all of the data submitted is valid according to the FDF rules, then nothing happens and the action on the data will take place. If all of the data submitted is valid according to the FDF rules, then nothing happens and the action on the data will take place. If any of the data submitted is not valid… If any of the data submitted is not valid…

Watch Out! A Boomerang! If any of the data submitted is not valid, then the page pointed to by the URL in the … tag in the FDF needs to be ready to receive: If any of the data submitted is not valid, then the page pointed to by the URL in the … tag in the FDF needs to be ready to receive: –h_’ ’ hidden form fields which contains all data fields submitted to the validator. –err_’ ’ hidden form fields which contain an error message for each field that failed validation.

Another Look… Form Validator System Form Validator System Form PostedSQL GeneratedSQL Run on DBChecked Against FDF Form Fields h_ and err_ Form Fields Valid Form Fields

Example Form Code <input type="text" name="txtItemName" value="#h_txtItemName#" > value="#h_txtItemName#" ><br> #err_txtItemName# #err_txtItemName# Steps to receive erred form data from the Form Validator Steps to receive erred form data from the Form Validator –Check for the presence of h_field-name and set the value of the form element that equal to it. –Check for the presence of err_field-name and output the error in some way if it exists. –Check for the presence of err_group-id. Whenever you have set up a group by using the … tags in the FDF, the form needs to be set up to receive errors which happen at the group level. They will be stored in the “err_ ” form field.

Form Validator Summary Create Form Definition File Create Form Definition File Call Form Validator before using the Form elements Call Form Validator before using the Form elements Create the Form in such a way that it is capable of filling in the form elements with posted data and displaying the error messages associated with bad fields. Create the Form in such a way that it is capable of filling in the form elements with posted data and displaying the error messages associated with bad fields.

Form Validator Questions? Questions?