search

client9 / libinjection

SQL / SQLI tokenizer parser analyzer
Other
1k stars 274 forks source link

Add parser for Microsoft (and others?) money type #5

Closed client9 closed 11 years ago

client9 commented 12 years ago

as mentioned in http://www.client9.com/2012/09/06/libinjection-new-techniques-in-detecting-sqli-attacks/ http://www.client9.com/2012/07/27/new-techniques-in-sql-obfuscation/

MS SQL Server has a money type, that uses the "$" and can contain commas. Should be easy to add to the parser.

client9 commented 12 years ago

update: basic types $1000.00 parse correctly. still to do: $1,000.00 which is a bit tricky since 1,234 is also an implied money type so is that "$1,234" or "1", "234" Does it matter?