3 ms·
Pop quiz: What is the singular cause of SQL injection, XSS, and stack overflows that causes a security vulnerability? ... The answer is: Data being treated as
by sarciszewski 11y ago
Pop quiz: What is the singular cause of SQL injection, XSS, and stack overflows that causes a security vulnerability?
...
The answer is: Data being treated as an instruction.
Solution: Separate them so that data can never be interpreted as an instruction!
In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented.
(Not that SQLi is the only vulnerability possible.)
- mikeash 11y agoI'm not sure what your point is here, because what I'm advocating is precisely to make it easier to use parameterized queries and more difficult not to.
- sarciszewski 11y agoI wasn't being argumentative, I just thought that would be something worthwhile to add for people following along.
- mikeash 11y agoGotcha, sorry. "Pop quiz" always makes me think it's being sarcastic. So, yes, total agreement there. Parameterized queries are key. I find it crazy that anything else ever existed, let alone still gets used.
- sarciszewski 11y agoAh, yeah, I hadn't considered the normal usage. Most people don't realize how much these vulnerabilities have in common, in the abstract, until you frame it like that.