3 ms·
From the post: $id = $q->param('id'); $stmt = "select envip,mailfile,headers,subject,size,fromid,toid,date from quamail where id = $id"; Yikes. His claime
by tyingq 4y ago
From the post:
$id = $q->param('id');
$stmt = "select envip,mailfile,headers,subject,size,fromid,toid,date from quamail where id = $id";
Yikes. His claimed expertise is "Protect your e-mail server from ransomware attacks" too.
- classichasclass 4y agoHi, Bobby Tables!
- deleted 4y ago[deleted]
- azinman2 4y agoI’m not terribly familiar with Perl. Will that interpolate at string creation, or is that just text in a string that the db driver will later do parameter bindings with?
- AnimalMuppet 4y agoNo, Perl strings are interpolated at creation.
- Areading314 4y agoThis is a classic SQL injection bug/security flaw
- Areading314 4y agoIronic since I always thought one of the coolest features in perl was taint analysis, which allows keeping track of all unparsed user input: https://www.geeksforgeeks.org/perl-taint-method/#:~:text=Taint%20mode%20is%20used%20to%20keep%20track%20of,any%20data%20that%20comes%20from%20outside%20the%20code https://www.geeksforgeeks.org/perl-taint-method/#:~:text=Tai....
- tyingq 4y agoYes, it will interpolate. The DBI package he's using does support parameter bindings with a ? character. He's just doing it wrong.