4 ms·

How is sql injection even still a thing? It's completely trivial to escape and validate user-supplied values with any modern library. It's straight up coding ma

How is sql injection even still a thing? It's completely trivial to escape and validate user-supplied values with any modern library. It's straight up coding malpractice not to. Aside from attacking badly written forms on sites that haven't been updated since the early 2010s, is there really a large attack surface against modern libraries in the wild?

deleted 3y ago
[deleted]
gfody 3y ago
straight up coding malpractice is rampant
- belter 3y ago
  Nobody was ever fired for coding malpractice but many for not hitting their targets.
jrumbut 3y ago
It was pretty easy ten years ago too, but somehow it remains a problem.
fulafel 3y ago
Same goes for memory safety in programming languages, constant streamof RCE vulnerabilities in browsers, the ongoing climate disaster, etc. <10% of people mak a lot of noise and worry about stuff that is on fire, the silent majority is more yolo.
- noduerme 3y ago
  I'd say that memory safety is still a very much unsolved problem if you're working close to the metal. It's not a solved problem with tons of well-worn routes in every language like escaping database queries is. As much as I love hacking in C++ to try to understand how to manage my own memory and write everything back to C-style pointers, as code golf, I would never put that shit into production without using well-tested libraries to do what I was trying to do. Memory management and security is far more complicated a problem than showing a first year intern how to use escaping / binding and never concat strings into a query.
deleted 3y ago
[deleted]
oweiler 3y ago
As long as there is string concatenation and SQL libs accept queries as a string there will be SQL injections.
- noduerme 3y ago
  How does someone learn SQL these days and go about getting a job doing it, without having it drilled into them that you must never concatenate strings and stick them in a raw query? Isn't anyone who's capable of learning SQL capable of understanding this?

deleted 3y ago

[deleted]

gfody 3y ago

straight up coding malpractice is rampant

belter 3y ago
Nobody was ever fired for coding malpractice but many for not hitting their targets.

jrumbut 3y ago

It was pretty easy ten years ago too, but somehow it remains a problem.

fulafel 3y ago

Same goes for memory safety in programming languages, constant streamof RCE vulnerabilities in browsers, the ongoing climate disaster, etc. <10% of people mak a lot of noise and worry about stuff that is on fire, the silent majority is more yolo.

noduerme 3y ago
I'd say that memory safety is still a very much unsolved problem if you're working close to the metal. It's not a solved problem with tons of well-worn routes in every language like escaping database queries is. As much as I love hacking in C++ to try to understand how to manage my own memory and write everything back to C-style pointers, as code golf, I would never put that shit into production without using well-tested libraries to do what I was trying to do. Memory management and security is far more complicated a problem than showing a first year intern how to use escaping / binding and never concat strings into a query.

deleted 3y ago

[deleted]

oweiler 3y ago

As long as there is string concatenation and SQL libs accept queries as a string there will be SQL injections.

noduerme 3y ago
How does someone learn SQL these days and go about getting a job doing it, without having it drilled into them that you must never concatenate strings and stick them in a raw query? Isn't anyone who's capable of learning SQL capable of understanding this?