Search code examples
sqldelphisql-injection

Protecting strings within a Delphi application

We have a Delphi 2006 application that drives a MS SQL Server database.

We have found a vulnerability where it is possible to load the executable into a hex editor and modify the SQL.

Our long term plan is to move this SQL to CLR stored procedures but this is some way off since many of our clients still use SQL 2000.

We've thought about obfuscating the strings, does anyone have a recommendation for a tool for doing this?

Is there a better solution, maybe code signing?

Solution

  • Can't you encrypt all your queries and put them to the resource file? During runtime, firstly you would have to:

    1. Load your query string from resource.
    2. Decrypt it.

    Then you just run your query as before.

    That should not be a big problem. Of course if you are not storing your queries in some resource / folder than you need to refactor your application a bit. But you should store them anyway in some organized manner. So you will be hitting a two birds with one stone here ;-)

    For encryption of the strings you could use a free library called DCPCrypt.