I've just launched some new code onto the site that will, hopefully, keep the SQL Injectors from damaging the site. What I've done is placed some code at the top of every page that examines each piece of data that is sent to the website server. There are specific key words and characters that the "scrubber" or "firewall" catches. Those are the pieces of the SQL Injector code that are readily identifiable.

Unfortunately, for the time being this new code is going to cause a lot of "false positive" rejections. You may accidentally enter one of the more common characters that is in the script. I'd tell you what they are, but then I wouldn't be able to post this. :) How about 1337 speak: 3x3cut3 is a bad word.

There will also be some scripts that just fail because of the coding in them.

As I confirm that scripts are not subject to an vulnerabilities, I will dumb down the scrubber or take it off of the script completely. I will start with the most common scripts, like the news and comments. It will take some time to work through them. But, I get a notification every time the firewall picks up bad input, so I can tell easily what needs to be fixed.

Since I launched the code 3 hours ago, it's already rejected 7 SQL Injector attacks.

Jac