I am trying to pick a value out of a SQL script (in C# using Regex) that has been defined by the person that created the script and can then be replaced when needed by someone else.
I have managed to do this using the greater and less than symbols twice e.g. SELECT * FROM users WHERE username = '<<username>>' and this works well.
The problem I’m having is that when I go to add this script into the database to store it(using an aspx page), it throws the following error:
System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (ctl00$MainBody$tstScriptTextBox="...username = '<<username>>';").
My question is: Are there any other symbols that will not be used in a SQL script and not cause any problems with Regex?
Have a read of this article Script Exploits Overview – the Exception is less about specific symbols but as the title suggests, more about potential script exploits.