4 ms·
> The official docs for _years_, if not decades, included them. The docs for how you were supposed to do SQL were just full of the antipattern of building queri
by mike_d 5y ago
> The official docs for _years_, if not decades, included them. The docs for how you were supposed to do SQL were just full of the antipattern of building queries by string formatting and concatenation.
PHP directly exposed the libmysqlclient C library. Any language that provides the ability to send a raw SQL query (hint: almost all of them) has documentation you can copy and paste to introduce an injection vulnerability.
You'll find injection vulnerable examples in the MySQL docs themselves: https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-query.html https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-query.html
- iamgopal 5y agoMySQL docs shouldn’t worry about injection.
- mike_d 5y agoSo why should Perl, Go, PHP, or Rust?
- cerved 5y agobecause it's serious if it's a web server?
- deleted 5y ago[deleted]
- thallium205 5y agoBecause not everything that uses MySQL is a web server?
- iamgopal 5y agoBecause those language are usually used at application level, and application does need to worry about wrong input. Databases doesn’t need to worry about if some correct security level input ask to delete the database , it should delete it, not to question the input , but at application level , that is not acceptable. How much simpler can this get ?
- iamgopal 5y agoWhy downvote ? Why database needs to worry about executable wrong input ? That’s input ( App ) level problem. Database will do what it is asked to do.
- anakaine 5y agoBecause people learn from and refer to the documentation. Examples therein should be presented in a manner that demonstrates safe execution.
- nextaccountic 5y ago> You'll find injection vulnerable examples in the MySQL docs themselves: https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-query.html https://dev.mysql.com/doc/c-api/8.0/en/mysql-real-query.html I can't find those examples, is there something in the mysql docs that I can copy and paste and be instantly vulnerable?