4 ms·
What was wrong with that change that allowed them to get hacked? Edit, can I guess that this isn't how to do proper sql parameterized input? > s.account_id =
by kyrra 5y ago
What was wrong with that change that allowed them to get hacked?
Edit, can I guess that this isn't how to do proper sql parameterized input?
> s.account_id = #{@id}
I don't know ruby at all...
- rsynnott 5y agoSomething along the lines of "https://thewebsite.com/the_url?max_id=); https://thewebsite.com/the_url?max_id=); DROP TABLE orange_face_paint ; [.. make the remainder valid sql here]" I would think. Essentially, it allows user-provided input to do anything; it's the most trivial form of SQL injection vulnerability.