Timeline for SQL injection is 17 years old. Why is it still around?
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 24, 2016 at 16:00 | comment | added | Out of Band | I really like t his answer and I'd be really interested in seeing such a syntax-tree solution. However, as Steffen Ullrich says, human stupidity knows no bounds, so I bet there'd be people who'd build this syntax tree by concatenating strings and then using their favorite language's eval pendant to turn it into an actual data structure. So then we'd have two gaping security holes where there was only one to start with. :-( | |
| Jul 5, 2016 at 20:10 | comment | added | T. Sar | I do not agree that parameters are a pain to use in dynamic query-building. That it's not hard at all - once we had to develop our own hibernate-like solution for a in-house project, and the parameters where one of the most easy parts do deal with. | |
| Jul 4, 2016 at 1:38 | comment | added | Criticizing Israel not allowed |
@PeterCordes Using the more safe APIs won't force people to not use string concatenation. How would it? You can easily do $db->buildQuery("select * from users where username = '$username'")->execute() or similar.
|
|
| Jun 30, 2016 at 13:41 | comment | added | paparazzo | I am a SQL developer and do not agree with this "When you have an application that needs to construct query text at runtime, prepared query parameters are a big pain to use." It is no harder to create secure query in a program than it is by hand. | |
| Jun 29, 2016 at 19:28 | comment | added | Peter Cordes | Existence of old tutorials teaching the bad way is also a major problem for things like PHP, where a lot of code is copy&pasted by people that don't understand it. | |
| Jun 29, 2016 at 19:26 | comment | added | Peter Cordes | As far as the most trivial vulnerabilities from naive use of string concatenation, they're still common in code written by people who don't know what they're doing because the less-safe APIs haven't been removed. If DB interface functions in PHP and other languages completely removed the old-style flat-string APIs (breaking tons of existing code), a lot of homebrew code written by people that don't really know how to program would be somewhat safer. | |
| Jun 29, 2016 at 15:09 | comment | added | RBarryYoung | Cannot upvote this answer enough. I have been saying this for decades, it is so great to hear at least one other person saying it too. | |
| Jun 28, 2016 at 22:21 | comment | added | supercat |
I don't think there would be anything wrong with using innerHTML if it were limited to creating anonymous text-only objects. It's a lot more practical to be able to set a field to This is <b>important</b>: whatever rather than having to create and insert a separate nested object for the bold-face text. Unfortunately, I know of no mechanism for creating that kind of aggregate object which would simply be incapable of creating more "dangerous" kinds of objects.
|
|
| S Jun 28, 2016 at 11:06 | history | mod moved comments to chat | |||
| S Jun 28, 2016 at 11:06 | comment | added | Rory Alsop♦ | Comments are not for extended discussion; this conversation has been moved to chat. | |
| Jun 28, 2016 at 1:39 | history | edited | Luis Casillas | CC BY-SA 3.0 |
added 342 characters in body
|
| Jun 27, 2016 at 18:12 | history | edited | Luis Casillas | CC BY-SA 3.0 |
edited body
|
| Jun 27, 2016 at 16:42 | history | edited | Luis Casillas | CC BY-SA 3.0 |
added 67 characters in body
|
| Jun 27, 2016 at 6:58 | comment | added | Walfrat | Relational databases still don't offer a standard, ... on sending queries as strings. Database are accessed by networks, so the API to generate secured query is always on application sides. Furthermore that would require them to implements that solution in every languages. They have already implemented drivers to communicate, perform transactions and allow to do parametrized query easier. I don't think we can really ask the more on their side. | |
| Jun 27, 2016 at 5:54 | history | edited | Luis Casillas | CC BY-SA 3.0 |
added 23 characters in body
|
| Jun 27, 2016 at 5:49 | history | answered | Luis Casillas | CC BY-SA 3.0 |