Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

URL encoding and decoding question.


  • Please log in to reply
4 replies to this topic

#1 Cohensalve

Cohensalve

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:05 PM

Posted 28 July 2013 - 10:34 AM

This is an example from a book I've read, but I don't understand how it works.
 
A web admin may attempt to block SQL injections by  blocking input containing the apostrophe character.
 
However, an input containing double encoding may be able to defeat the filter.
 
eg : %2527
 
Why is this so ? The book stated that %2527 will become %27 after decoding it. What's the process behind it ?
 
Guidance is appreciated.
 

Edited by Cohensalve, 28 July 2013 - 10:36 AM.


BC AdBot (Login to Remove)

 


#2 SpywareDoc

SpywareDoc

  • Members
  • 674 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Maryland, USA
  • Local time:08:05 AM

Posted 28 July 2013 - 01:08 PM

Wikipedia: Canonicalization > Unicode


Edited by SpywareDoc, 28 July 2013 - 01:09 PM.


#3 Cohensalve

Cohensalve
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:05 PM

Posted 29 July 2013 - 12:15 AM

 

Thanks for the link. But I still do not get it. If the filter blocks apostrophe input, shouldn't %2527 become only 27 ?



#4 SpywareDoc

SpywareDoc

  • Members
  • 674 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Maryland, USA
  • Local time:08:05 AM

Posted 29 July 2013 - 09:16 AM

%25 = %

%27 = '



#5 Cohensalve

Cohensalve
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:05 PM

Posted 29 July 2013 - 10:06 AM

Hmm since it blocks apostrophe ( %25) , it removes the '25' which is actually represents % (%25) instead to nullify the apostrophe which gives the result of %27 ?

Edited by Cohensalve, 29 July 2013 - 10:11 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users