title: how to prevent null byte injection from querystring
body: <p>The Nessus Vulnerability Scanner was run against a legacy code website. There's a lot of advice about how to prevent <strong>null byte injection</strong> attacks with PHP but I cannot find anything about fixing this in classic ASP with VBScript.</p>
  
  <p>Here's the scanner's attack on our public site:</p>
  
  <pre><code>http://www.mortgagedataweb.com/mds/marketshare/ParmsV2.asp?Menu=%00&lt;"kzwezl%20&gt;
  </code></pre>
  
  <p>I've tried to add validity checking to the <code>QueryString</code> input but my efforts have not worked. Something about the <code>%00</code> results in masking my attempts to check for proper values. Here are some relevant code snippets:</p>
  
  <pre><code>Function getUserInput(input)    
      Dim newString
      If Len(input) = 0 Then
          getUserInput = ""
          Exit Function
      End If
      newString = input        'this was omitted in original post but was in fact in the code
      newString = Replace(newString, Chr(0), "")  'I thought this would fix it !  
      newString = Replace(newString, "--", "")
      newString = Replace(newString, ";", "")          
      newString = Replace(newString, Chr(34),"'") 
      newString = Replace(newString, "'", "") 
      newString = Replace(newString, "=", "=") 
      newString = Replace(newString, "(", "[") 
      newString = Replace(newString, ")", "]")
      newString = Replace(newString, "'", "''")
      newString = Replace(newString, "&lt;", "[")
      newString = Replace(newString, "&gt;", "]")  
      newString = Replace(newString, "/*", "/") 
      newString = Replace(newString, "*/", "/")
      getUserInput = newString
  End Function
  
  implied_Menu = UCase(getUserInput(Request.QueryString("Menu")))  'store Menu value for Fast-Path link
  Select Case implied_Menu
      Case "FHA_ZP", "C_ZP", "J_ZP", "F_ZP"
          implied_SQLName = MARKETSHAREZip
      Case "P_ALL", "P_MA", "P_ST", "P_ZP", "P_CT", "P_NATION"
          implied_SQLName = PMIMARKETSHARE
      Case "FHA_ALL_D", "FHA_MA_D", "FHA_ST_D", "FHA_CT_D", "FHA_ZP_D", "FHA_NATION_D"
          implied_SQLName = FHAMARKETSHAREDETAILS
      Case ""
          implied_SQLName = MARKETSHARE
      Case Else
          Response.Write("&lt;h2&gt;Invalid Menu parameter&lt;/h2&gt;")
          Response.End
  End Select
  </code></pre>
  
  <p>The Menu values that are proper are either:</p>
  
  <ul>
  <li>totally missing (that is, <code>Menu=</code> is not in the <code>QueryString</code>)</li>
  <li>part of series of valid values as sketched in the <code>Select Case</code> logic above</li>
  </ul>
  
  <p>On my development machine, I can change <code>%00</code> to <code>%0</code> and have the error flagged with the <code>Response.Write</code> message then <code>Response.End</code>, but something about the <code>%00</code> gets past my attempts to check it. </p>