1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
# DotNet SQL
exec[[:space:]]*sp_executesql
execute[[:space:]]*sp_executesql
exec[[:space:]]*sp_.*
execute[[:space:]]*sp_.*
exec[[:space:]]*xp_.*
execute[[:space:]]*sp_.*
exec[[:space:]]*@
execute[[:space:]]*@
executestatement[[:space:]]*\(
executeSQL[[:space:]]*\(
\.ExecuteSqlRaw[[:space:]]*\(
#setfilter
executeQuery[[:space:]]*\(
GetQueryResultInXML[[:space:]]*\(
#adodb
#sqloledb
#sql[[:space:]]*server
#driver
Server\.CreateObject
#\.Provider
\.Open([[:space:]]*\(|[[:space:]]+[\"\']).*
#ADODB.recordset
New[[:space:]]+OleDbConnection
ExecuteReader[[:space:]]*\(
#DataSource
SqlCo(mmand|nnection).*\=
#Microsoft.Jet
#SqlDataReader
#ExecuteReader
#GetString
#SqlDataAdapter
#CommandType
StoredProcedure[[:space:]]*\(
#System\.Data\.sql
[Cc]onnection[Ss]tr(ing)?[[:space:]]*\=[[:space:]]*[\'\"].*
# Stricter matching to avoid javascript spam
[\'\"][Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(WHERE|where)[[:space:]]+[^\;]+=.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
[\'\" ]+AND[[:space:]]+.*=.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(LIKE|like)[[:space:]]+[^\(\)\;]+(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(ORDER[[:space:]]+BY|order[[:space:]]+by)[[:space:]]+.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
(LIMIT|limit)[[:space:]]+.*(\{[A-Za-z0-9]+\}|[\'\"][[:space:]]+\+)
|
