101 reputation
3
bio website 127.0.0.1
location Richmond, VA
age 39
visits member for 3 years, 7 months
seen Jun 24 at 13:54

OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

It's really not that hard, y'all...

$db = new PDO(...);
$stmt = $db->prepare('
    SELECT some_stuff
    FROM some_table
    WHERE some_field = ?
');
$stmt->execute(array('some value'));

while ($row = $stmt->fetch())
{
     ...
}

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.


Jun
9
comment How can I know that developers will be ethical and not record my password in plaintext
@Agent_L: Problem is, even if someone doesn't have enough access to change the hash, but can somehow view it, they can still send that and be in. The hash ends up with most of the weaknesses of a plaintext password (with the main exception of its not being useful on third-party sites).
May
10
comment I have been accused of sending porn to my fiance's ex
@cpast: If the other party wants to do anything in court, then they have to come up off some evidence. And if Gina's innocent, then there is no such evidence, and the other party will be even more obviously the one causing trouble.
May
10
comment I have been accused of sending porn to my fiance's ex
Is porn a crime where you live? If not, why give a rat's ass? I'd send her some porn just because it's funny when people freak out over it.
May
10
comment Is there a theorem that states “whatever can be done with trust can be done without”?
You don't need a trusted third party if you don't need a trusted second one. Or if you're willing to travel all over the continent checking IDs and personally collecting public keys for the sites you visit. (But wait...where do IDs come from? D'oh!)
Feb
14
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
That leakage that you may have sent a message, is part of the reason some people advocate using crypto all the time. If you only use it for stuff that you really want to hide, then Eve can safely assume that she's just found something more interesting than your cookie recipe.
Feb
3
comment Should I take over a compromised website from another hacker?
The "self-defense" argument is unadulterated bullshit. Defense and offense are not the same thing online; unlike in the physical world, defending yourself does not require attacking back (and anything more than what is required, wouldn't legally be self-defense), and counterattacking doesn't even make you any safer.
Feb
3
comment Should I take over a compromised website from another hacker?
No one cares about your code, and even if they do, it's the source code they want, not binaries. The chance of someone running your malicious code on their machine is slim at best. More likely, they'll be running it on your machine -- since what they're generally after is the ability to launch future attacks against third parties anonymously and without taking up their own bandwidth and CPU.
Nov
25
comment What makes it difficult to have a hardware antivirus?
@tepples: Good luck doing that with a PC, though. You already see people intentionally breaking the security of their iPhones, because security and restrictions are basically one and the same.
Aug
8
comment Is there ever a good reason _not_ to use TLS/SSL?
@LieRyan: "...usually does so out of actual concerns that they have" and the modern mentality of "TLS/SSL everywhere" kinda clash. Either there are actual/specific concerns (which means not doing it is justifiable in other cases), or using TLS/SSL is just "what you should do" these days (and actual concerns easily get drowned out by all the chanting about best practices).
Jun
23
comment How to know if firmware is stealing my information?
AV and firewalls probably wouldn't help either, if the compromise is in the firmware. The OS depends on the system to tell it what's going on, and the firmware can make the system lie. Particularly if the hardware was designed to allow that type of behavior. And network activity at that level would bypass pretty much any firewall rules at the OS level or above.
Jun
22
comment Pionee Red: Is this a Phishing attack? What should we do?
Define "went a little further". If you logged in, you might have gotten compromised. That's not a google login page. (Google would be using SSL and a google.com domain, for starters.)
Jun
22
comment Adding 65K buffer to protect from buffer overflows?
Note, too, that if the canary is dead, the only safe option is to abort the program. You don't know what else has been modified at that point.
Jun
3
awarded  Commentator
Jun
3
comment Why does an anti-forgery token need so many bits?
@Gili: 128 bits is not much at all. It's 32 hex digits. The size of an MD5 hash, or of a GUID...and your language of choice makes it trivial to generate at least one of those. And frankly, expiring a token after 5 minutes will annoy pretty much everybody who posts a form but doesn't type all that fast. :P
May
22
comment What's to stop someone from 3D print cloning a key?
This. Most locks are hackable. The main thing they do is add enough difficulty to keep honest people and half-hearted criminals out. Someone determined to get in will find/use the weak link in your security, which might not be the lock at all. It might be the door itself, an open window, the fact that the security staff is a bit too "helpful" sometimes...etc.
May
14
comment Why would you not permit Q or Z in passwords?
If different keyboard layouts were the issue, passwords would only be able to have digits (and possibly the punctuation marks from Shift+digit). Dvorak and QWERTY only match on the digit keys and the letters A and M. AZERTY doesn't even match on the letters.
Apr
28
comment Can I determine a private key given the encrypted data and corresponding cleartext?
Consider: I could make up my own B, and encrypt it with my target's public key to get A. (Key word being public -- these keys are supposed to be sharable with the world.) Were that enough info on its own to recover a private key, public key crypto would be worthless.
Apr
24
comment Can “cat-ing” a file be a potential security risk?
For reference, PuTTY by default will respond to a Control-E with the string "PuTTY" (but you can make it say something else if you want). Which isn't really a security issue unless someone's listening in on your connection or injecting stuff...in which case, if that's your machine, you already have much bigger problems than someone knowing you use PuTTY.
Apr
15
comment Are there “secure” languages?
Turing completeness basically means a language can emulate any other computer (=> program => compiler => language feature) in existence. It doesn't mean a feature you're emulating can ever be as powerful, or as exploitable, as if it were native to the language. Java being a prime example -- you could emulate pointers using an array and int "pointers", but you'd still have to intentionally write code to allow a buffer to overflow. And it wouldn't affect anything outside the array.
Mar
24
comment Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
@RobertPetz: "Entirely possible" overstates a bit. That's what SSL certificates are for. You'd never get a certificate for bbc.com signed by a reputable CA, and the disreputable ones won't get you any better acceptance than self-signing (which will flag the site in every browser i know of). And the signatures aren't exactly trivial to forge.