2 ms·
You think SQL injection vulnerabilities are due to the SQL language itself? That's like saying JS is flawed specifically because too many people used eval(…).
by ttfkam 4y ago
You think SQL injection vulnerabilities are due to the SQL language itself?
That's like saying JS is flawed specifically because too many people used eval(…).
- gspencley 4y agoYour comment misses my broader point, which is that you don't NEED a text-based programming language to interface with a persistence engine. And so through that lens, yeah it's pretty obvious that if SQL didn't exist then neither would SQL injection vulnerabilities. That doesn't mean that an alternative interface wouldn't have its own potential attack vectors. It's just one example of the complexity invited and brought upon us by using a general purpose text-based programming language to interface with storage.
- ttfkam 4y agoAre those languages newer than SQL? Did their designers know that SQL integration would eventually be needed? If so, then why didn't they incorporate the glue as part of their language design? I wonder if you are directing your ire toward the wrong language(s).