title: sql injection attacks
body: <p>I have an asp.net site...Last days, I saw in my logs that I'm being attacked with sql injection like:</p>
  
  <blockquote>
  <pre><code>Exceptia: Error Caught in Application_Error event Error in: http://gramma.ro/Site/DetaliiProdus.aspx?c=m1&amp;p=1465&amp;s1=45&amp;s2=79/**/or/**/1=@@version))--
  </code></pre>
  </blockquote>
  
  <p>Of course this will throw an exception because I check the parameters before doing any sql query:</p>
  
  <pre><code>Error Message:Input string was not in a correct format.
  </code></pre>
  
  <p>For all this exceptions I redirect the user to a specific error page.</p>
  
  <p>Of course, these attacks do not affect me right now (I'm using parameterized sql commands), but I am taking the ips and put them in <strong>IIS - Ip Address and domain restrictions</strong> so that ip no longer can access my site.</p>
  
  <p>My question: is anything else I can do? Seems that this malicious user, even I block his ip, is going and tries the same attack from another ip (I have blocked about 6 ips in last 3 days which is quite ugly...). Can you suggest anything else I should do?</p>
  
  <p><strong>UPDATE:</strong> All these attacks put <code>/**/or/**/1=@@version</code> instead of a query parameter value so I am pretty sure the attack it's NOT a random issue from the users but a real SQL injection attack. The problem is that these ips are from different locations so I cannot report them to some internet providers or hosts companies...</p>