3 ms·
SQL injection meets prompt-injection…
by DaiPlusPlus 3y ago
SQL injection meets prompt-injection…
- calcsam 3y agoCouldn’t you solve this simply by executing from a user without these permissions?
- newaccount74 3y agoSure, but it's something that the customer has to do. I wouldn't rely on customers to configure everything correctly, especially if there is no way to discover the configuration error before the damage has been done.
- panarky 3y agoNEVER CREATE CARTESIAN PRODUCTS For example: SELECT clicks.session_id, clicks.page_url, sessions.user_id FROM clicks, sessions; (This context is guaranteed to generate lots of cartesian products.)