Timeline for SQL injection is 17 years old. Why is it still around?
Current License: CC BY-SA 3.0
37 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2017 at 4:07 | review | Close votes | |||
| Jul 31, 2017 at 8:46 | |||||
| Apr 14, 2017 at 19:29 | comment | added | Syntax Junkie | The "Is there no fix?" wording makes me suspect a misconception: SQLi is not a "bug" that needs to be fixed. The question might be rephrased as, "Why hasn't a 100% foolproof, automated way of blocking SQLi been developed?" The answer is that there is no 100% foolproof, automated way to distinguish legitimate SQL from illegitimate SQL. Only the designer of an application will know if submitted text should allow SQL or not. So it's up to the designer to implement the various protections mentioned in the other answers. | |
| Jul 20, 2016 at 11:04 | review | Close votes | |||
| Jul 20, 2016 at 14:42 | |||||
| Jul 12, 2016 at 14:09 | comment | added | Guy Schalnat | In my opinion, it comes down to the users (or the buyers, which is almost the same thing, in cases where the software is bought). They are willing to pay less for cheap junk rather than more for solid programs. This is far bigger than just in the computer industry, of course, but it boils down to the fact that the extra time to correctly prevent SQL Injection isn't worth it to the business, and they pay our paychecks. | |
| Jul 8, 2016 at 11:30 | history | edited | schroeder♦ | CC BY-SA 3.0 |
deleted 41 characters in body
|
| Jul 6, 2016 at 19:58 | answer | added | Andy Lester | timeline score: 16 | |
| Jul 3, 2016 at 23:49 | answer | added | mystupidstory | timeline score: 4 | |
| Jun 30, 2016 at 14:05 | comment | added | paparazzo | Seat belts have been around for more than 17 and some people still don't use them. SQL injection will always be around as you have trusted users that need to write direct queries. If you have un-trusted (user) data there are reliable tools (prepared / parameterized) for queries that 100% prevent injection. | |
| Jun 30, 2016 at 11:25 | comment | added | Max Williams | Picking people's pockets is still "a thing" after thousands of years of trouser-wearing. | |
| Jun 30, 2016 at 2:06 | comment | added | iHaveacomputer | Non tech-savy customers simply wont pay for code changes until they see something bad happen that hurts their bottom line: "It's not in the budget!", "I dont see the problem, it's been working fine the last 15 years". They don't know that they have been hacked via SQL injection because they never check their server logs, and the hacker is never nice enough to send them an email ... | |
| Jun 29, 2016 at 19:38 | comment | added | JamesFaix | I'd ask the same thing about SQL. | |
| Jun 29, 2016 at 18:06 | answer | added | Bradley Thomas | timeline score: 2 | |
| Jun 29, 2016 at 16:58 | answer | added | Jedi | timeline score: 8 | |
| Jun 29, 2016 at 15:14 | comment | added | RBarryYoung | Buffer overflow exploits have existed for over 30 years, yet they are still a thing, despite the fact that it really is not that hard for the vendors to fix. | |
| Jun 29, 2016 at 14:11 | comment | added | zzzzBov | You know that malaria is still around right? and that actually kills people. | |
| Jun 29, 2016 at 11:18 | answer | added | niilzon | timeline score: 6 | |
| Jun 29, 2016 at 1:54 | answer | added | Neil Davis | timeline score: 4 | |
| S Jun 28, 2016 at 7:13 | history | mod moved comments to chat | |||
| S Jun 28, 2016 at 7:13 | comment | added | Rory Alsop♦ | Comments are not for extended discussion; this conversation has been moved to chat. | |
| Jun 28, 2016 at 6:30 | answer | added | pppp | timeline score: 1 | |
| Jun 28, 2016 at 0:24 | review | Close votes | |||
| Jun 28, 2016 at 8:04 | |||||
| Jun 27, 2016 at 20:01 | answer | added | David Mulder | timeline score: 25 | |
| Jun 27, 2016 at 18:36 | history | protected | CommunityBot | ||
| Jun 27, 2016 at 17:10 | answer | added | TessellatingHeckler | timeline score: 285 | |
| Jun 27, 2016 at 16:10 | answer | added | Bron Davies | timeline score: 12 | |
| Jun 27, 2016 at 12:05 | answer | added | Colin Cassidy | timeline score: 8 | |
| S Jun 27, 2016 at 10:05 | history | edited | Anders | CC BY-SA 3.0 |
edited title
|
| Jun 27, 2016 at 9:36 | review | Suggested edits | |||
| S Jun 27, 2016 at 10:05 | |||||
| Jun 27, 2016 at 9:15 | answer | added | Bob Ortiz | timeline score: 9 | |
| Jun 27, 2016 at 7:27 | history | tweeted | twitter.com/StackSecurity/status/747330518262251520 | ||
| Jun 27, 2016 at 7:26 | history | edited | Anders | CC BY-SA 3.0 |
added 6 characters in body
|
| Jun 27, 2016 at 7:23 | answer | added | Nick Gammon | timeline score: 64 | |
| Jun 27, 2016 at 6:00 | answer | added | h4ckNinja | timeline score: 30 | |
| Jun 27, 2016 at 5:49 | answer | added | Luis Casillas | timeline score: 123 | |
| Jun 27, 2016 at 5:25 | answer | added | Steffen Ullrich | timeline score: 486 | |
| Jun 27, 2016 at 5:14 | review | First posts | |||
| Jun 27, 2016 at 8:45 | |||||
| Jun 27, 2016 at 5:13 | history | asked | Ishan Mathur | CC BY-SA 3.0 |