Should AC9 have code in the global.asax to stop sql injection the way Gold does? I remember that if it wasn't there in Gold, site would fail a security scan.
//TERMINATE SQL INJECTION ATTEMPTS
int maxQueryLength = 500;
string rawUrl = Request.RawUrl;
int qIndex = rawUrl.IndexOf("?");
if (qIndex > -1)
{
string query = Request.RawUrl.Substring(qIndex).ToUpperInvariant();
if (query.Length > maxQueryLength || query.Contains("DECLARE%20"))
{
//POTENTIAL ATTACK
Response.Clear();
Response.Write("INVALID REQUEST");
Response.Flush();
Response.End();
}
}