4 ms·

Actually this is common old fashioned industry standard: http://thedailywtf.com/Articles/Injection_Rejection.aspx http://thedailywtf.com/Articles/Injection_Rej

by seven 16y ago

Actually this is common old fashioned industry standard: http://thedailywtf.com/Articles/Injection_Rejection.aspx http://thedailywtf.com/Articles/Injection_Rejection.aspx We where laughing our asses of. My name and the name of the other in-house guy, both contain an 'and'. Just our boss, could login and had no problem. :)

petercooper 16y ago
Except, the bad code as shown requires whitespace (\s) before and after the "bad" terms, so the names the Daily WTF post mentions should pass through it. if (preg_match('/\s['.implode('|',$badSqlCode).']+\s/i', $sqlcode)) They probably didn't realize this wouldn't catch any of the bad terms at the very start or end of their code, though :-)