Timeline for How to limit the impact of and reduce the risk of SQL injection for existing website?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 6, 2018 at 18:11 | comment | added | Tom | there is pgcrypto for PostgreSQL, for example. Don't know about other databases. Can't imagine stuff like Oracle doesn't have equivalents. | |
| Jul 6, 2018 at 13:48 | comment | added | AndrolGenhald | While this sounds like a good idea at first, most databases don't support good password hashing functions, and database queries are often logged. I suppose you retrieve just the salt and parameters, hash, then do another query to compare the hash, but that seems too complicated to be worth it for most sites. | |
| Jul 6, 2018 at 10:17 | history | answered | Tom | CC BY-SA 4.0 |