Re: SQL and IDArray

2006-02-02 Thread Charlie Hanlon 
I may not have been clear.  My global error handler sends the emails to my 
address.  My sites throw errors, I fix them.  In this case, I noticed the 
WHERE i.uniqueID = '' IDArray[index] '' within the error message that I 
rec'd.  I am assuming that the site visitor substituted IDArray[index] where 
the url.id would have been, something like

mypage.cfm?id=40

mypage.cfm?id=IDArray[index]

I have added a  to the sql statement, but am inquiring as to 
wheter this was an attempted hack

charlie



~|
Message: http://www.houseoffusion.com/lists.cfm/link=i:4:231123
Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4
Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4
Unsubscribe: 
http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
Donations & Support: http://www.houseoffusion.com/tiny.cfm/54

RE: SQL and IDArray

2006-02-02 Thread Munson, Jacob 
Why would someone try to hack your site and then email you the error
they received?  Seems counter productive.

> -Original Message-
> From: Charlie Hanlon [mailto:[EMAIL PROTECTED] 
> Sent: Thursday, February 02, 2006 8:04 AM
> To: CF-Talk
> Subject: SQL and IDArray
> 
> I rec'd an email regarding an error with one of my apps, here 
> is the SQL error:
> 
> [Microsoft][ODBC SQL Server Driver][SQL Server]Line 8: 
> Incorrect syntax near 'IDArray'. 
> 
> 
> SQL = "SELECT someFields
> 
>   FROM myTable i 
> 
>  WHERE i.uniqueID = '' IDArray[index] ''  
> 
> Data Source = "myDSN"
> 
> 
> 
> Was someone trying to tamper with my app and if so, what are 
> the implications of IDArray.
> 
> thanks in advance for some insight into this.

This transmission may contain information that is privileged, confidential 
and/or exempt from disclosure under applicable law. If you are not the intended 
recipient, you are hereby notified that any disclosure, copying, distribution, 
or use of the information contained herein (including any reliance thereon) is 
STRICTLY PROHIBITED. If you received this transmission in error, please 
immediately contact the sender and destroy the material in its entirety, 
whether in electronic or hard copy format. Thank you. A1.



~|
Message: http://www.houseoffusion.com/lists.cfm/link=i:4:231120
Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4
Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4
Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
Donations & Support: http://www.houseoffusion.com/tiny.cfm/54