I'm using some SQL injection attack prevention code I found on these forums here.
I have reduced the list of "bad strings" somewhat, to: "--", ";", "/*", "*/", "@@". I've also made the code log anything it traps. I'm getting a lot of events from it like this:
'QueryString[d]' = 'ABF9m9gJK-fD9uz7z9B8gxZ3niVarMd55SggsWtDiqYr8XiGhNmax50oC--Bap680'
This means that this value was passed in Request.QueryString["d"]. Evidently it's not a SQL injection attempt, but where does this come from? I don't generate this as part of my application, unless it comes from the framework - but as a query string, I would have expected to see it in a browser address bar during testing and use. Is it a spider perhaps?
I'm about to ...
Go to the complete details ...