Timeline for SQL query sanitation (black list)
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 31, 2012 at 18:54 | vote | accept | AaronS | ||
| Jan 20, 2012 at 18:35 | answer | added | jl01 | timeline score: 0 | |
| Jan 18, 2012 at 19:05 | comment | added | Clockwork-Muse |
There are a number of tokens on that list (notably, CAST and datatypes) which should be allowed, for a variety of reasons. Also, how were you planning on checking the statement for these tokens? Depending on your strategy, the check can either be bypassed, or return a false positive (like if someone has a column named begin that's a timestamp?). You've also eliminated the use of cursors, which are usually used to read data in blocks (a strategy for decreasing application access counts), which feels wrong.
|
|
| Jan 18, 2012 at 18:34 | answer | added | dr jimbob | timeline score: 1 | |
| Jan 18, 2012 at 17:29 | answer | added | Wayne In Yak | timeline score: 2 | |
| Jan 18, 2012 at 17:27 | history | tweeted | twitter.com/#!/StackSecurity/status/159688354345123840 | ||
| Jan 18, 2012 at 17:16 | comment | added | rook | Data theft is the biggest concern. A select or union is the most dangerous thing an attacker is going to do. | |
| Jan 18, 2012 at 11:11 | comment | added | AaronS | People do mistakes | |
| Jan 18, 2012 at 11:01 | comment | added | CodesInChaos | Why do you need sanitation if only trusted users can create queries and those queries are sent from a trusted web server? Just defense in depth, or did I miss an attack? | |
| Jan 18, 2012 at 10:34 | answer | added | Lucas Kauffman | timeline score: 13 | |
| Jan 18, 2012 at 8:27 | history | asked | AaronS | CC BY-SA 3.0 |