3 ms·

>It has everything to do with Php and the attitude that goes with it. Doing a quick search on GitHub gives a good number of similar exploits, several per page

>It has everything to do with Php and the attitude that goes with it. Doing a quick search on GitHub gives a good number of similar exploits, several per page of results: C# https://github.com/search?l=C%23&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=C%23&q=sqlcommand+where+username... Java https://github.com/search?l=Java&q=sqlcommand+where+username&ref=searchresults&type=Code&utf8= https://github.com/search?l=Java&q=sqlcommand+where+username... Just look at the sheer inventiveness that goes into doing things The Wrong Way; it's not a language-specific problem.

merb 10y ago
well in C#/java you can have User getUser(long id) {}; and you definitly now that if you concat the id with the SQL that it actually is not a vulnerability. Nobody can inject arbitary SQL into the Long/Int variable.
- lsaferite 10y ago
  And in PHP 7.0 (because who wants to use something earlier) you have: function getUser(int $id) : User
- mootothemax 10y ago
  Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields. The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
  - merb 10y ago
    Thats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)

merb 10y ago

well in C#/java you can have User getUser(long id) {}; and you definitly now that if you concat the id with the SQL that it actually is not a vulnerability. Nobody can inject arbitary SQL into the Long/Int variable.

lsaferite 10y ago
And in PHP 7.0 (because who wants to use something earlier) you have: function getUser(int $id) : User
mootothemax 10y ago
Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields. The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
- merb 10y ago
  Thats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)