Member Avatar for whisper_101
whisper_101 1 Light Poster

Hi Guys

My hosting company confirmed that recently it appeared that somebody was trying to hack into my website. I was able to confirm the page used but not whether they actually got through - no data in the database was changed.

I have never come across this before and my hosting company advised me to have a word with my developer to secure my code - which is myself. I have also read a few articles on how attackers do what they do, however I am still anxious and so I have a few questions:

How might I better secure my code in asp to make it more difficult for attacks to occur through the login (username+password) fields?

Is there a way to protect my asp code? (if this will help)

Are there any added safeguards I can place upon my MSSQL database?

Cheers! W:)

  • 1 Contributor
  • 0 Replies
  • 66 Views

Dani AI

Generated

Hi — good that your host flagged the activity and that the DB was not changed. Short, practical steps you can take now:

Never build SQL by concatenating user input. Use parameterized queries / prepared statements and validate inputs server-side. Add rate-limiting or account lockouts to slow automated attacks. Use HTTPS and store passwords with a proper salted, slow hash. See OWASP for clear, implementation-focused guidance: SQL Injection Prevention Cheat Sheet and Password Storage Cheat Sheet.

Classic ASP specifics: ASP runs server-side so source should not be downloadable — but misconfiguration can expose things. Harden IIS: disable directory browsing and verbose error pages, tighten NTFS permissions so the web user cannot modify code, and avoid leaving raw connection strings in web files (use a DSN or Windows Integrated Security where possible). Obfuscation is not a substitute for fixing injection and auth logic.

MSSQL hardening: run the web app with a DB user that has only needed rights (no sa/sysadmin), restrict SQL Server network access with a firewall, enable auditing/alerts for failed logins and suspicious queries, keep SQL Server patched, and maintain regular backups. Microsoft also documents SQL injection mitigation details: SQL injection guidance.

If you want, paste the login routine (remove credentials) and I will point out exact changes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.