3 ms·
There are best practices for handling dynamite, too, but I wouldn't build a safe with it. Nobody should be writing code that queries databases using tainted st
by peterwwillis 9y ago
There are best practices for handling dynamite, too, but I wouldn't build a safe with it.
Nobody should be writing code that queries databases using tainted strings. Perl has had a taint mode for almost 30 years. Ruby supposedly has a taint mode, but I'm not a Ruby dev so I don't know how it affects the vuln you mention.
- dsl 9y ago3/4 of the Perl scripts I have audited have had bad input sanitation in front of open() or exec(). I'll take SQLi over RCE any day.
- peterwwillis 9y ago....so enable Taint mode and fix the errors? And why would you think your code is vulnerable to SQLi and not RCE, or any other user input-related exploit?