4 ms·
For anyone interested in the history of SQL Injection, the generally accepted first article talking about it was in 1998 from rain.forest.puppy http://phrack.or
by raesene9 8y ago
For anyone interested in the history of SQL Injection, the generally accepted first article talking about it was in 1998 from rain.forest.puppy http://phrack.org/issues/54/8.html#article http://phrack.org/issues/54/8.html#article
It's interesting that it's managed to persist as a serious issue for over 20 years now.
- ahje 8y agoI've seen plenty of web sites running 10+ year-old code written by someone's neigbor's kid with an ancient PHP handbook in hand. Luckily, deprecating the mysql extension in PHP in favor of the mysqli extension has broken a _lot_ of ancient code like that.
- raesene9 8y agoYeah PHP has been a rich source of SQLi issues in the past, but it can crop up anywhere. I've seen it most languages/database engines and even where an ORM is in play (e.g. ActiveRecord in rails) you can get it with bugs in the ORM implementations.
- Moru 8y agoIt's not only mysql though, our first system was mssql with asp and the database was cleared or filled with spam several times per month until we made a new one with php and mysql. About 15 years ago I guess.
- raesene9 8y agoYou can see SQLi in pretty much every system that supports SQL (even including MS Access!), although the impact tends to be worse where the Database engine has more functionality for things like running operating system commands, where it can lead to total system compromise.