4 ms·
>SQL injection is super trivial to prevent, right? How are we still falling for this? Because the bug is super trivial to fix, it's also super trivial to do. N
by Dalewyn 3y ago
>SQL injection is super trivial to prevent, right? How are we still falling for this?
Because the bug is super trivial to fix, it's also super trivial to do. Not to mention, the human mind is naturally inclined to not care about trivial stuff, which leads to careless mistakes at many levels and thus Bobby Tables dropped out of school.
- dontlaugh 3y agoIn most environments, it’s more effort to interpolate values into queries than to use parameters.
- silon42 3y agoHuh, no? Tt's very easy to do it incorrectly. It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).
- throwaway894345 3y agoDon't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).
- magicalhippo 3y agoNot only more effort, but also the only way in certain cases as not everything supports parameterization. The IN operator for example is one where we fall back to string interpolation, though not directly with user values.