gskourou

amen

I have also seen backend application which strip out certain "bad" tags (i.e. <script>).

I remember being able to perform an XSS attack by sending a payload that looked like:

<sc<script>ript>alert(/XSS/)</sc<script>ript>

This passed the WAF inspection, but then got trimmed by the backend application and this is what was left:

<script>alert(/XSS/)</script>

written in the page source.

Maybe I'll write about that case too if I find where I put the attack evidence. You can anyway see that bad validation by the actual application programmers can disable the WAF's capabilities.

I am not sure if parametrized statements solve 100% of your SQLi problems, but I know they at least offer basic protection. I have to study them in order to give you a complete answer, but I found this https://stackoverflow.com/questions/6786034/can-parameterize...