3 ms·

String concatenated SQL queries can be executed in pretty much any language. This has nothing to do with PHP in particular.

by WA 10y ago

babyrainbow 10y ago
It has everything to do with Php and the attitude that goes with it. Php puts up the appearance that web development is child's play . That in itself is not bad. But what makes it bad is that it provide absolutely no safety by default, in how it does that. This is true with the stuff in the language and outside of it (Documentation, community etc..).
- mootothemax 10y ago
  >It has everything to do with Php and the attitude that goes with it. Doing a quick search on GitHub gives a good number of similar exploits, several per page of results: C# https://github.com/search?l=C%23&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=C%23&q=sqlcommand+where+username... Java https://github.com/search?l=Java&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=Java&q=sqlcommand+where+username... Just look at the sheer inventiveness that goes into doing things The Wrong Way; it's not a language-specific problem.
  - merb 10y ago
    well in C#/java you can have User getUser(long id) {}; and you definitly now that if you concat the id with the SQL that it actually is not a vulnerability. Nobody can inject arbitary SQL into the Long/Int variable.
    - lsaferite 10y ago
      And in PHP 7.0 (because who wants to use something earlier) you have: function getUser(int $id) : User
    - mootothemax 10y ago
      Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields. The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
      - merb 10y ago
        Thats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)
SFJulie 10y ago
+1 I have been told that I did not understood agile/scrum rules because during code reviews of django/pylons frameworks I was spotting the SQL and shell injections. It seems agile is the new death of problem solving by suffocating with hugs of being nice. But believe me: there is no way a 150k$/year coder will take nicely a 50k$/year coder says : there is an obvious security flaw coming from your usual coding practice. Apparently the way in python communities to avoid injection is security by fight club rules. 1st rules you do not talk of SQL injections 2nd rules you take an ORM that supports sanitizing of arguments, but you do not use it. I have been profoundly chocked at how my experience of python, the same as my experience of PHP is impacted by the social pressure of the «norms». People being pissed at my remarks always then pointed at me not using integrally PEP8/pylint/flakes (even though I use pylint to catch only potential errors). Something is rotten when programming is not about designing/coding/correcting anymore but just about following fashions and trends. But that is the way, I guess, some remains the king of the hill and can buy their expensive cars.

String concatenated SQL queries can be executed in pretty much any language. This has nothing to do with PHP in particular.

by WA 10y ago

String concatenated SQL queries can be executed in pretty much any language. This has nothing to do with PHP in particular.

babyrainbow 10y ago

It has everything to do with Php and the attitude that goes with it. Php puts up the appearance that web development is child's play . That in itself is not bad. But what makes it bad is that it provide absolutely no safety by default, in how it does that. This is true with the stuff in the language and outside of it (Documentation, community etc..).

mootothemax 10y ago
>It has everything to do with Php and the attitude that goes with it. Doing a quick search on GitHub gives a good number of similar exploits, several per page of results: C# https://github.com/search?l=C%23&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=C%23&q=sqlcommand+where+username... Java https://github.com/search?l=Java&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=Java&q=sqlcommand+where+username... Just look at the sheer inventiveness that goes into doing things The Wrong Way; it's not a language-specific problem.
- merb 10y ago
  well in C#/java you can have User getUser(long id) {}; and you definitly now that if you concat the id with the SQL that it actually is not a vulnerability. Nobody can inject arbitary SQL into the Long/Int variable.
  - lsaferite 10y ago
    And in PHP 7.0 (because who wants to use something earlier) you have: function getUser(int $id) : User
  - mootothemax 10y ago
    Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields. The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
    - merb 10y ago
      Thats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)

SFJulie 10y ago

+1 I have been told that I did not understood agile/scrum rules because during code reviews of django/pylons frameworks I was spotting the SQL and shell injections. It seems agile is the new death of problem solving by suffocating with hugs of being nice. But believe me: there is no way a 150k$/year coder will take nicely a 50k$/year coder says : there is an obvious security flaw coming from your usual coding practice. Apparently the way in python communities to avoid injection is security by fight club rules. 1st rules you do not talk of SQL injections 2nd rules you take an ORM that supports sanitizing of arguments, but you do not use it. I have been profoundly chocked at how my experience of python, the same as my experience of PHP is impacted by the social pressure of the «norms». People being pissed at my remarks always then pointed at me not using integrally PEP8/pylint/flakes (even though I use pylint to catch only potential errors). Something is rotten when programming is not about designing/coding/correcting anymore but just about following fashions and trends. But that is the way, I guess, some remains the king of the hill and can buy their expensive cars.