Simple regex question (C#, SQL Server)

Question

I have some Regex, it looks like this:

string regexForDrop = @"^((%27)|'|(\-\-))\s*(d|%64|%44)(r|%72|%52)(o|%6F|%4F)(p|%70|%50)$";

It works fine, when i write to the input "--drop", but it does not works, when i write "drop table users" or something like that. I need that it would be working, no matter what comes after "--drop". How i can implement that?

Thanks

I would highly advise against using a regex as a method of security for SQL injection. It's a recipe for getting hacked — JaredPar
– JaredPar, Commented Mar 8, 2010 at 21:21
Even if it works for "--drop", what about "--truncate" or any host of other evil things someone could do. — Eric Petroelje
– Eric Petroelje, Commented Mar 8, 2010 at 21:23
Yes, I know about SP, I just do some research for studies about regex to. — vts123
– vts123, Commented Mar 8, 2010 at 21:30

Michael D. Irizarry · Accepted Answer · 2010-03-08 21:21:08Z

6

It seems you trying to prevent a sql injection attack. For this use Parameterized Queries this way you don't need to check for injections.

Good Read:
http://weblogs.asp.net/scottgu/archive/2006/09/30/Tip_2F00_Trick_3A00_-Guard-Against-SQL-Injection-Attacks.aspx

answered Mar 8, 2010 at 21:21

Michael D. Irizarry

6,3825 gold badges33 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

vts123 Over a year ago

Yes, I know about SP, i just do some research for studies about regex to. Thanks for the link, I would read it.

user180100 · Accepted Answer · 2010-03-08 21:22:34Z

2

string regexForDrop = @"^((%27)|'|(\-\-))\s*(d|%64|%44)(r|%72|%52)(o|%6F|%4F)(p|%70|%50).*$";

? or without the $

answered Mar 8, 2010 at 21:22

user180100

1 Comment

KM. Over a year ago

+1, whatever @Vytas999 reason, you wrote the code to solve it

cleek · Accepted Answer · 2010-03-08 21:26:11Z

1

Remove the '$' at the end of your regular expression. $ matches the end of the input string.

answered Mar 8, 2010 at 21:26

cleek

8748 silver badges15 bronze badges

Collectives™ on Stack Overflow

Simple regex question (C#, SQL Server)

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related