3 ms·

How can you know that there's no sanitization just from this blog post?

• MichaelApproved 7y ago
  I think OP is getting the wrong idea from the screen shot in the article. There's a pic of an SQL query being run from a terminal. They might be thinking that it's a screen shot from the actual code.
  • aloknnikhil 7y ago
    It's open source. https://github.com/RoganMurley/Ring-of-Worlds/blob/master/server/src/User.hs https://github.com/RoganMurley/Ring-of-Worlds/blob/master/se...
    • anyfoo 7y ago
      This looks perfectly fine? Are you referring to the fact that they don't escape special characters like ' in the string? With the proper interfaces, like using prepared statements (which this likely uses in the backend, if this is an actual SQL db), instead of putting queries together just by concatenating strings, escaping strings is not only unnecessary but actively harmful.
• deleted 7y ago
  [deleted]
• aloknnikhil 7y ago
  https://github.com/RoganMurley/Ring-of-Worlds/blob/master/server/src/User.hs https://github.com/RoganMurley/Ring-of-Worlds/blob/master/se... It's all open source
  • dwohnitmok 7y ago
    It looks properly sanitized to me. The DB library being used is creating prepared SQL statements underneath the hood.