3 ms·
In case you have any confusion about this, please note that the term "Innovative" is used here to mean "likely to cause Hacker News readers to spew soda out th
by gluejar 16y ago
In case you have any confusion about this, please note that the term "Innovative" is used here to mean "likely to cause Hacker News readers to spew soda out their noses".
- leftnode 16y agoHah, right, I came expecting some really innovative new way of handling SQL injection attacks.
- billybob 16y agoOoops - looks like somebody forgot to put "TRUNCATE" in the list!
- redangstrom 16y agoIndeed! And "alter table", "create view", etc... I'm glad I didn't joint that credit union when I considered it a few years ago.
- megablast 16y agoIt is possible that they server is not given access to these functions, so they didn't need to be checked for, in the input. This presents its own problems, if for some reason in the future they need to add one of these missing functions to the servers access, and don't recognise that they need to add the check as well. But anyway, it is great to see the boss' nephew getting some work.
- tptacek 16y agoCome on. Typing "truncate" in a text field doesn't do anything to the database. Neither does "insert" or "update". What it does is generate stupid alarms and break pageflows when you have an improperly configured web filter.