People need to learn to sanitize SQL...

Ashyre

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the keyword 'AND'.

/voters/vtr_process.asp, line 94

/Sigh.

From:

http://www.shapethefuture.org/voters/voter_status.asp

jpaull

I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

C'mon, people!!!

Jeff_S

Sanitize? No. Simply use parameters? Yes.

campkev

@jpaull said:

I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

C'mon, people!!!

I love this kind of comment. If you don't upgrade an existing app that is built on an "outdated" technology, you get comments like this one. If you do update it because it's on an "outdated" technology, you get "WTF??? Why update when the existing app is working fine."

jpaull

@campkev said:

@jpaull said:
I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

C'mon, people!!!

I love this kind of comment. If you don't upgrade an existing app that is built on an "outdated" technology, you get comments like this one. If you do update it because it's on an "outdated" technology, you get "WTF??? Why update when the existing app is working fine."

Point taken.... However, the existing app apparently does NOT work fine and appears to be using embedded SQL, which by itself should warrant a re-write.

campkev

@jpaull said:

@campkev said:
@jpaull said:
I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

C'mon, people!!!

I love this kind of comment. If you don't upgrade an existing app that is built on an "outdated" technology, you get comments like this one. If you do update it because it's on an "outdated" technology, you get "WTF??? Why update when the existing app is working fine."

Point taken.... However, the existing app apparently does NOT work fine and appears to be using embedded SQL, which by itself should warrant a re-write.

None of which has anything to do with it being written in Classic ASP

Benanov

Oh this one is gonna be wide open in 30 minutes.

A zip code of ';-- reveals:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark after the character string ';-- AND AddrNum = AND BIRTHDATE = ''.

/voters/vtr_process.asp, line 9

I'm sure they're running as SA too. That box is toast.

fyjham

Might be worth removing the URL while they still have a database?

Or am I just being too kind? :P

arty

@fyjham said:

Might be worth removing the URL while they still have a database?
Or am I just being too kind? :P

Since it's for voter registration, I'd hope everone waits til late tomorrow to play :-)

samanddeanus

Gee, I hope Bobby Tables doesn't visit that site...

ActionMan

@samanddeanus said:

Gee, I hope Bobby Tables doesn't visit that site...

Shouldn't matter, unless Bobby's Zip code is "90210; DROP DATABASE voters; --"

ac_1

Actually, that's not the database name, and the user name they log in with indicates they probably didn't give it rights to drop any databases. I didn't have the heart to try though.