4 ms·
The exploit relies on the behavior of backtick quotes in mySql, which I'd never encountered before. Do other SQLish databases have similar features?
by thyrsus 5y ago
The exploit relies on the behavior of backtick quotes in mySql, which I'd never encountered before. Do other SQLish databases have similar features?
- andreareina 5y agoOther rdbms have identifier quoting, yes. But the problem isn't that identifier quoting exists, it's that the library interprets an object as a key = value statement (compounded treating the key as an identifier), which it shouldn't. ... AND password = password = 1 is just wrong, quoted or not.
- yawaramin 5y agoAlso, the fact that the library doesn't validate the type of the input data ({password: 1} when the password should be a string...). This is just a cascading chain of failures.
- useerup 5y agoYes. Almost all DBMSs has a way to delimit table/column names (for instance when a name contains spaces or special characters. However, proper DBMSs expose parameters as 1st class concepts through the API. That has several advantages, some of which: 1) It is more secure, as you will not have to do this dangerous escaping before invoking. Parameters are substituted by the DBMS. 2) The DBMS can better understand the "dynamic" part of a query and cache query plans.
- epitactic 5y agoMySQL uses `backticks` for quoting identifiers, ANSI SQL and PostgreSQL use "double-quotes", SQL Server and MS Access use [square brackets]. SQLite supports all three: https://www.sqlite.org/lang_keywords.html https://www.sqlite.org/lang_keywords.html