5 ms·

It has everything to do with Php and the attitude that goes with it. Php puts up the appearance that web development is child's play . That in itself is not ba

It has everything to do with Php and the attitude that goes with it. Php puts up the appearance that web development is child's play . That in itself is not bad. But what makes it bad is that it provide absolutely no safety by default, in how it does that. This is true with the stuff in the language and outside of it (Documentation, community etc..).

mootothemax 10y ago
>It has everything to do with Php and the attitude that goes with it. Doing a quick search on GitHub gives a good number of similar exploits, several per page of results: C# https://github.com/search?l=C%23&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=C%23&q=sqlcommand+where+username... Java https://github.com/search?l=Java&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=Java&q=sqlcommand+where+username... Just look at the sheer inventiveness that goes into doing things The Wrong Way; it's not a language-specific problem.
- merb 10y ago
  well in C#/java you can have User getUser(long id) {}; and you definitly now that if you concat the id with the SQL that it actually is not a vulnerability. Nobody can inject arbitary SQL into the Long/Int variable.
  - lsaferite 10y ago
    And in PHP 7.0 (because who wants to use something earlier) you have: function getUser(int $id) : User
  - mootothemax 10y ago
    Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields. The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
    - merb 10y ago
      Thats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)

mootothemax 10y ago

>It has everything to do with Php and the attitude that goes with it. Doing a quick search on GitHub gives a good number of similar exploits, several per page of results: C# https://github.com/search?l=C%23&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=C%23&q=sqlcommand+where+username... Java https://github.com/search?l=Java&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=Java&q=sqlcommand+where+username... Just look at the sheer inventiveness that goes into doing things The Wrong Way; it's not a language-specific problem.

merb 10y ago
well in C#/java you can have User getUser(long id) {}; and you definitly now that if you concat the id with the SQL that it actually is not a vulnerability. Nobody can inject arbitary SQL into the Long/Int variable.
- lsaferite 10y ago
  And in PHP 7.0 (because who wants to use something earlier) you have: function getUser(int $id) : User
- mootothemax 10y ago
  Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields. The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
  - merb 10y ago
    Thats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)