3 ms·
Fire the folks in charge. SQL injection vulnerability is a sign of poor process design and weak programming.
by okeumeni 18y ago
Fire the folks in charge.
SQL injection vulnerability is a sign of poor process design and weak programming.
- lucky 18y agoselect * from users
- lucky 18y agoselect from user where user='d%'
- lucky 18y agoselect * from users
- Prrometheus 18y agoWhat do you have to do besides escaping special characters in input fields?
- jfornear 18y agoEverytime SQL injection comes up everyone says how easy it is to prevent with one line of code, and then no one ever shares that one line! From Wikipedia: Using Parameterized Statements Parameterized statements use parameters (sometimes called placeholders or bind variables) instead of embedding user input in the statement. In many cases, the SQL statement is fixed. The user input is then assigned (bound) to a parameter. This is an example using Java and the JDBC API: PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS WHERE PASSWORD=?"); prep.setString(1, pwd);
- okeumeni 18y agoEmbedded SQL is poor programming period!
- dnaquin 18y agoEspecially when The contractor had no idea how to find and fix the Web page vulnerability that allowed the SQL injection attack code to execute successfully.