Cross site scripting and SQL injection

Coldfusion has built-in defence against cross-site scripting and injection attacks. That is the scriptprotect attribute of the cfapplication tag. However, it was only included from Coldfusion MX7.x onwards. Have you thought about migrating to Coldfusion 8? You will get many other benefits besides.

Luckily, there is another handy device against cross-site scripting and injection attacks, namely, the cfqueryparam tag.  It was already present in MX 6.1.

SQL injection usually happens where user data enters a query. So, you will have to do an extended search for all the queries in your application. Identify where form variables and URL variables enter queries.

Do some validation for those variables just before a query. For example, a simple test for numbers using isNumeric() may be all that  is required. If a value fails validation, reject it, throw an exception, and abort.

Use cfqueryparam in each case to enter form and URL variables into a query. Beware of variables in other scopes, such as session.userID, that originally entered the application as form or URL variables. They too have to be sanitized using cfqueryparam.

Last but, certainly, not least, the psychological part of the defence. Remember there is someone at the other end, trying to cause mischief to your application. It might even be a customer, a colleague or an acquaintance of yours, or an ex-customer or ex-colleague. Realize it could be someone in the same building or even in the same room as you.

Take the war to them. Try to identify IP addresses. Look for clues and patterns in the attacker's behaviour. Frequency, times of day, parts of the application attacked, and so on. Study the data an attacker enters. Attackers often get carried away and unintentionally leak out details about themselves.

Build a dossier. In most countries, certainly in all Western countries, cross-site scripting and injection attacks, particularly concerted attacks, count as a crime  nowadays.