2 ms·
On HN this week something like half of the articles (e: from a Google search) about PHP had SQLi in them.
by bitexploder 5y ago
On HN this week something like half of the articles (e: from a Google search) about PHP had SQLi in them.
- manquer 5y agoWhile SQLi is still quite common, the use of good libraries and prepared statements even in PHP has increased a lot say in last 10 years, the % of projects / services on which SQLi was possible should have also reduced. In that HN thread you talked about someone had mentioned till sometime back even the official docs used to have examples with SQLi, which of course they don't anymore, making it slightly harder for junior devs to make those mistakes, each step is improvement. I am not saying they already solved, I am saying it becomes harder to hack with some techniques over time as defenses become more standard and best practices become actually common place.
- bitexploder 5y agoMy old book I wrote on PHP4 had SQLi in it.. heh. And I still ended up in appsec years later. Been doing that for 15+ years but my roots are software dev, so I use that and try to have a lot of empathy for developers. When I got started app sec was nascent and just becoming it’s own thing, and many in infosec had a very blame oriented mindset with developers. So it’s great to see how far we have brought things.