4 ms·
People who want to do string concatenation will continue to do so no matter what we tell them. At some point, we have to educate users. Giving them an easy-to-u
by sarciszewski 11y ago
People who want to do string concatenation will continue to do so no matter what we tell them. At some point, we have to educate users. Giving them an easy-to-use alternative is a step in the right direction.
- mikeash 11y agoWhy not have the obvious API call for making a query only accept constant strings? You can still have an escape hatch for the rare cases where an expert needs to do something fancy, but hide it well and make it scary and you shouldn't have many problems.
- sarciszewski 11y agoRight, well, "constant strings" don't really exist in scripting languages, and before you mention objects that encapsulate them, what's to stop developers from building them elsewhere before passing the string to an object that encapsulates them? Chicken and egg. Education is the security strategy that pays forward the most.
- mikeash 11y agoApologies, I meant string literals. There's no technical reason the language couldn't make it so that string literals can be identified at runtime. There are several good ways to put a stop to SQL injection. Better education is one, better APIs is another. There is no reason to just give up on the idea of using SQL queries directly because of injection attacks.
- sarciszewski 11y agoPop quiz: What is the singular cause of SQL injection, XSS, and stack overflows that causes a security vulnerability? ... The answer is: Data being treated as an instruction. Solution: Separate them so that data can never be interpreted as an instruction! In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented. (Not that SQLi is the only vulnerability possible.)
- mikeash 11y agoI'm not sure what your point is here, because what I'm advocating is precisely to make it easier to use parameterized queries and more difficult not to.
- sarciszewski 11y agoI wasn't being argumentative, I just thought that would be something worthwhile to add for people following along.
- mikeash 11y agoGotcha, sorry. "Pop quiz" always makes me think it's being sarcastic. So, yes, total agreement there. Parameterized queries are key. I find it crazy that anything else ever existed, let alone still gets used.
- sarciszewski 11y agoAh, yeah, I hadn't considered the normal usage. Most people don't realize how much these vulnerabilities have in common, in the abstract, until you frame it like that.