22 ms·
How not to protect against SQL injection (view source)
- Animus7 16y agoI have a feeling that this site won't be up much longer after making front page of HN, and it will have nothing to do with server load.
- goalieca 16y agoIt was on reddit yesterday I believe which means tons of kiddies saw that. People were guessing that it included sanity checking on both sides because it wasnt down yet.
- ZeroComplete 16y agoI'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
- donniefitz2 16y agoI was thinking the same thing. Let's hope that's true.
- ZeroComplete 16y agoIt would seem kind of stupid if they were smart enough to implement validation but not smart enough to limit user access to it. Of course there's no accounting for the depths of stupidity.
- chc 16y agoThat would actually not surprise me at all. There are a lot of Web devs who can make a site that renders in the browser and mostly works, but can't wrap their minds around the difference between server-side code and client-side. Browse through the JavaScript tag on Stack Overflow and you'll come across more than you can shake a stick at. Many people (either due to willful ignorance or a sad gap in their education) write functions like: function getTime() { <?php return time(); ?> } It's not at all improbable that somebody told them their site was vulnerable to SQL injection, so they took a brief glance at the Wikipedia page and said, "I know, I'll just stop people from writing this stuff." So they open up the page where people might be entering the malicious text and write some code that will stop them. They run it in their browser and it works — none of their SQL strings make it through. They have now fixed the problem, as far as they are concerned, and the site owner doesn't know enough to tell them how utterly braindead their approach is.
- robertduncan 16y agoThere may actually be a good reason for writing code like that. The time the content was generated by the server, perhaps?
- chc 16y agoThat wouldn't be a good reason for writing that code. Putting it in a function like that suggests that you expect the value to change. It's like the xkcd joke where a random() function is implemented to return 4, as determined by a fair dice roll. If you just wanted to store the time the page was generated, it would make more sense to use a constant — for example: window.pageBirthday = <?php echo time(); ?> Also, if they're on Stack Overflow asking why it doesn't correctly report the current time, that's a pretty good indicator that they're simply mistaken.
- yahelc 16y agoYeah, that function is useful for calculating the difference between server time and client time.
- spicyj 16y agoRight, I tried searching for "select" and it just redirected me back to the home page.
- nbpoole 16y agohttp://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/ http://www.reddit.com/r/programming/comments/gdviz/how_not_t... Based on some of the comments there, it doesn't look like it (or at least, it wasn't there several hours ago when Reddit stumbled upon the site). See http://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/c1muft1 http://www.reddit.com/r/programming/comments/gdviz/how_not_t... for some examples.
- julianc 16y agoMaybe the javascript is intentional, like a honeypot for hackers :)
- pbhjpbhj 16y agoYeah, maybe the 100+ validation errors in the markup are like a honeypot for web designers too ... I've not seen 1x1 gifs for a few years now. And leaking the MS SQL server errors and IIS errors are just adverts for MS (I only did genuine searches, "hotel" got me to an error page). I'm sure the silly long names are part of the ruse too. There is much that could be done with this site. Perhaps I could drop them a CV.
- somedev 16y agoSee my reply above. Yep, 1x1 gifs and table layouts were cutting edge back then ;)
- deleted 16y ago[deleted]
- LiteOn 16y agoThis is a great example of why a little knowledge is a dangerous thing.
- MatthewPhillips 16y agoSince they're using SQL Server (hint is that they are checking for "xp_"), you can get a list of all of their databases with "SELECT name FROM sys.databases", then loop through and drop them. Hope the web login doesn't have drop permissions.
- tptacek 16y agoAre they actually vulnerable? How do you know? People have gotten in serious trouble in the UK for "innocuously" testing web apps for SQL problems. Know that in both the UK and the US, you are taking a significant risk by prodding websites like this.
- MatthewPhillips 16y agoI have no idea if they are, hence "I hope their web login doesn't have drop permissions".
- tptacek 16y agoSince people on Reddit are apparently actually poking this thing, I just want to get in the warning: DON'T DO THAT.
- yuhong 16y agoYea, dropping tables or otherwise destroying their server is a very bad idea. FYI: http://news.ycombinator.com/item?id=2358058 http://news.ycombinator.com/item?id=2358058
- jrockway 16y agoThat's what those 5-euros-a-month VPN services are for, I assume.
- epo 16y ago"Testing" a web app when it is not your job to do so is self evidently a suspicious act, just like walking down a line of cars testing the door handles to see if any have been left unlocked would be a suspicious act.
- Joeri 16y agoThe saddest part is that tons of people will be reading this thinking that they're way smarter than that guy, while in fact their sites are wide open to exploitation as well. That last statement probably applies to me too. Doing web security well is hard, too hard. Everyone gets caught with a security bug sooner or later, even google. It's easy to laugh with silly coding like this, but I blame the technology for allowing SQL injection in the first place. SQL is simply a bad API to be using in a web app.
- Skalman 16y agoI don't think SQL is a bad API - it's just that every language makes it so difficult to use prepared statements! It shouldn't be harder than: sql_query('SELECT * FROM mytable WHERE name = ?', name) (I'm aware that this defeats the purpose of prepared statements to be reusable - this is just an API that's better than the current methods)
- tptacek 16y agoThis is the second time in a few days someone has made the point that web stacks make it hard to use prepared statements†. This is a one-liner in Rails. Does it not work in Python? How hard is it in PHP? † Which are not a cure-all for SQLI.
- T-hawk 16y agoI think the problem angle is slightly different: it's too easy to use simple string concatenation for SQL. That works across pretty much every web stack, so it's the path of least resistance to get something working, and many a developer never bothers to learn the proper idiom anew for every framework. Side note: We're jumping to conclusions by thinking that the javascript is the entire implementation. It's perfectly possible that the server is already safe against SQL injection and the javascript is just an extra line of defense. Maybe the client and server were done by separate programmers and the client programmer wanted to make sure he wouldn't get blamed. It's a government website: nobody in government ever got fired for being too careful. Or maybe the programmer had to do it to satisfy some non-technical bureaucrat who wanted to think that hacking attempts couldn't even reach his server.
- ascendant 16y agohttps://addons.mozilla.org/en-us/firefox/addon/groundspeed/ https://addons.mozilla.org/en-us/firefox/addon/groundspeed/
- jofabian 16y agoFunny is that I tried to warn them about that problem and their Feedback form doesn't work.
- dayjah 16y agofacepalm - though the 1/4 Englishman in me snickers at the Welsh!
- thomasfl 16y agoUpvote here if you too have discovered sql injection vulnerabilities in your own web apps.
- upgrayedd 16y agoHow about no.
- dgavey 16y agoIf you vote no, you haven't looked hard enough.
- Skalman 16y agoNo, really - I'm certain there aren't any in my code. SQL injections are extremely easy to protect against if you know how it works. There might however be other vulnerabilities.
- jedsmith 16y agoYou trust the library doing that protection for you too?
- tptacek 16y agoYeah? What i your "extremely easy" mechanism for avoiding SQLI? Is it, as I surmise from your previous comment, "using prepared statements for everything"? Because that isn't bulletproof.
- Devilboy 16y agoIt's bulletproof if you don't use string concatenation in your prepared statements. EDIT: No this doesn't limit you to 'simple queries'! How do you figure that? There are only a VERY small subset of problems you can't solve like this. So small that in 10 years I've only had to do it once and I write SQL Server 5 hours a day. Want to give me an example please?
- stevemoy 16y agoMy take on this is that the scriptwriter's goal was not to stop SQL injection attacks but rather prevent regular users from inadvertently screwing with the database. Looking at it that way makes it a much more understandable (and all-too-common, unfortunately) oversight.
- MattJ100 16y agoErm... if the server-side was already escaping properly then there would be no way for users to mess with the database. Only if it is not escaping properly is this code vaguely useful. It's not like you can't store semi-colons in an SQL database :)
- elboru 16y ago"Terms & Conditions: SECURITY We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect on line. We use encryption when collecting or transferring sensitive data such as credit card information." I don't know why but I just don't trust them...
- gary4gar 16y agoJavascript - It can be Disabled! Every Web Dev needs to remember this and Yet people tend to forget
- dasil003 16y agoA better principle is that you can not trust the client. Not only can javascript be disabled, it can also be modified, a new web page can be created posting to this endpoint, or one can send raw HTTP requests without a browser at all.
- MatthewPhillips 16y agoThey use javascript to submit the form, so that's not a vulnerability for them.
- Devilboy 16y agoYou can submit their form without using their JS
- iuguy 16y agoH.M. Government has a specific set of standards that apply to websites based on the impact of information assets contained on them (as well as other bits and pieces that I don't need to go into). The weird thing is, this site is for the Welsh Assembly which, as a devolved government has to meet the standards but is seen in certain respects as a 'foreign government' within the civil service (our H.M. Government sector). Make no mistake, there are some things that this site will have to comply with, but the implied and genuinely air-quoted 'measures' put forward would add nothing to any of this. A moderately large amount of this information is available on the Internet, start at http://www.cabinetoffice.gov.uk/resource-library/security-policy-framework http://www.cabinetoffice.gov.uk/resource-library/security-po... if you want a look. A brief look through the sitemap suggests they are holding or processing Personally Identifiable Information (PII) which puts them under the Data Protection Act. Again, the presence of the javascript doesn't imply actual SQL injection, but it definitely doesn't imply a measure against it. In this instance, the compliance requirements are fairly low. I guess the exam question is, can they pass the bar, or do they limbo under it?
- mixmax 16y agoI just fired off an e-mail to point out that they have a potentially serious security problem and they should get it fixed ASAP. I see this as a civic duty, and think that this is the kind of action you're required to perform if you see a serious problem. Writing an e-mail takes ten seconds, but the potential damage could well cost serious money.
- derleth 16y agoIf you're lucky, you aren't in the UK so they won't be able to arrest you instantly on the hacking charges. If you're very lucky, the place you are in won't honor their demands for extradition on the hacking charges.
- mixmax 16y agoNo offense, but I think you're a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don't expect anyone to sue me for that. Here's the mail I sent: Hi there, It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP. Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: http://news.ycombinator.com/item?id=2383857 http://news.ycombinator.com/item?id=2383857 It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: http://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/ http://www.reddit.com/r/programming/comments/gdviz/how_not_t... It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc. I have nothing to do with these postings, I just don't like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions. Hope you get it fixed before someone breaks it. Yours, Max
- Stormbringer 16y ago
- RossDM 16y agoWhen I was working in the financial sector, I came across an email thread involving a certain software vendor who had been notified of a SQL injection vulnerability. To fix it, they created an IF statement that did a string comparison to check for the exact SQL attack that had been used.
- arpy 16y agoPoor old Bobby Drop Tables will be out of luck again.
- d2 16y agoThere are more websites than competent admins so this kind of thing is inevitable. If you were a nice guy you would have reported it to the admin and left it at that.
- evo_9 16y agoWell at least form & function are equals.
- vain 16y agohttp://news.ycombinator.com/item?id=2370022 http://news.ycombinator.com/item?id=2370022 (CEO Friday: Why we don’t hire .NET programmers) Would an open source programmer do something like this?
- jarek 16y agocough php cough
- recoiledsnake 16y ago>Would an open source programmer do something like this? Why not? http://www.eweek.com/c/a/Security/Oracles-Suncom-Hit-Along-with-MySQLCom-in-SQL-Injection-Attack-727118/ http://www.eweek.com/c/a/Security/Oracles-Suncom-Hit-Along-w...
- Stormbringer 16y agoWould have been better protected if their javascript was programmed in Welsh... :D
- peterbe 16y agoHello!!! Has anybody hacked the site yet? Perhaps it would be nasty to delete all database tables but at least some sort of update would be funny?
- ignifero 16y agoThey are not scared of sql injection cause they have Styled Scrollbars!!
- teichman 16y agoSo for those of use who know nothing about websites: what is the correct way to protect against SQL injection?
- deleted 16y ago[deleted]
- tajddin 16y agoGenerally, on the server-side, you parameterize the query. Depending on the server-side language, a normal SQL query that would read SELECT * FROM myTable WHERE lastName = 'Smith' would be converted to something like SELECT * FROM myTable WHERE lastName = @lastnameparam. Then in code, you'd supply the value of @lastnameparam as 'Smith'. It depends on the language, but this is what you'd do in .NET, for example. In this case, the framework does the work for you by encoding the value of lastnameparam (it makes sure that whatever is supplied to lastnameparam isn't read as SQL).
- pyre 16y agoWell, since it wasn't necessarily answered explicitly anywhere, you don't want your validation code to run on the client (i.e. the browser) because the end-user has absolute control and can easily circumvent your controls. You have to protect yourself on the server-side where you have control.
- fghjrjrt 16y agoONLINE STORE: ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== Air jordan(1-24)shoes $30 Handbags(Coach l v f e n d i d&g) $35 Tshirts (Polo ,ed hardy,lacoste) $15 Jean(True Religion,ed hardy,coogi) $30 Sunglasses(Oakey,coach,gucci,A r m a i n i) $15 New era cap $12 Bikini (Ed hardy,polo) $20 accept paypal and free shipping ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )==== ====== ( http://www.fullmalls.com http://www.fullmalls.com )====
- JohnnyBrown 16y agoWell, it's still up after 8 hours, so apparently there was some server-side checking as well
- rosenjon 16y agoYeah...pretty sad. But at the same time, if the site isn't down by now, there is probably server side checking in place as well.
- 441069567 16y agowelcome our store,we have the best service and good price,you can find what you want in our online store. <a href="http://www.monster-beatss.com/sennheiser-c-2.html>Sennheiser http://www.monster-beatss.com/sennheiser-c-2.html>Sennhe... </a> <a href="http://www.monster-beatss.com/bose-headpones-c-3.html>Bose http://www.monster-beatss.com/bose-headpones-c-3.html>Bo... Headpones</a> <a href="http://www.monster-beatss.com/lady-gaga-headphones-c-4.html>Lady http://www.monster-beatss.com/lady-gaga-headphones-c-4.html&... Gaga Headphones</a> <a href="http://www.mbt-scarpe.net/mbt-baridi-shoes-c-2.html>MBT http://www.mbt-scarpe.net/mbt-baridi-shoes-c-2.html>MBT Baridi Shoes</a><a href="http://www.mbt-scarpe.net/mbt-baridi-shoes-mbt-baridi-womens-c-2_28.html>MBT http://www.mbt-scarpe.net/mbt-baridi-shoes-mbt-baridi-womens... Baridi Womens</a> <a href="http://www.ghd-midnight-uk.com/ghd-midnight-deluxe-collection-c-1.html>GHD http://www.ghd-midnight-uk.com/ghd-midnight-deluxe-collectio... Midnight Deluxe Collection</a> <a href="http://www.ghd-midnight-uk.com/ghd-midnight-collection-gift-set-c-2.html>GHD http://www.ghd-midnight-uk.com/ghd-midnight-collection-gift-... Midnight Collection Gift Set</a> <a href="http://www.ghd-midnight-uk.com/ghd-nobler-diamonds-gift-sets-c-20.html>GHD http://www.ghd-midnight-uk.com/ghd-nobler-diamonds-gift-sets... Nobler Diamonds Gift Sets</a> <a href="http://www.ghd-midnight-uk.com/ghd-pink-limited-edition-c-3.html>GHD http://www.ghd-midnight-uk.com/ghd-pink-limited-edition-c-3.... Pink Limited Edition</a> <a href="http://www.ghd-midnight-uk.com/ghd-iv-styler-green-c-5.html>GHD http://www.ghd-midnight-uk.com/ghd-iv-styler-green-c-5.html&... IV Styler Green</a>
- somedev 16y agoIt was me that actually built this site. Around 2000-2001. To give you a bit of background or "excuses": It was my first website at an agency, I'd just taught myself ASP and SQL in just a few months previous (with no help or guidance). If my memory serves me correct, that dodgy JavaScript was put in there by a more senior developer. I had no idea what SQL Injection was and it wasn't until at least a few years later that SQL Injection was even something any developers I knew were aware of - The Wikipedia page for SQL Injection (http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/SQL_injection) under "Known real-world examples" has the earliest dated at 2005 (but obviously, this vulnerability has been around forever). And yes, I'm still a Web Developer (front-end nowadays - that also knows much better than this) and no, I no longer work for that agency and haven't for a long time. In response to some of the comments: * I've seen many many developers write SQL Injection prone code at least 6 years after this was written. * Any developer that was around during 2000-2001 would know that this was before the time of CMS's (free or otherwise), libraries, frameworks, SQL abstraction layers etc. * I'm pretty sure there is some server-side sanitising done too (before we'd heard of the term SQL Injection). * I don't think it was using an SQL login with drop permissions.
- Lozzer 16y agoThe linked page seems very safe. It has a very bad form checking function, but no actual form...