4 ms·
Nicely written and the author clearly has more experience than myself. I did, however, get hit with a data breach via SQL injection, and everyone I spoke to (no
by 1nd1ansumm3r 3y ago
Nicely written and the author clearly has more experience than myself. I did, however, get hit with a data breach via SQL injection, and everyone I spoke to (not vendors or sales folks) seemed to agree that a WAF would have blocked the attack outright.
- jiggawatts 3y agoParameterised SQL queries would have blocked it outright also. Parameterised queries however don’t need an annual fee and a team of security engineers to babysit it.
- threeseed 3y agoWAF don't require a team of security engineers to babysit. Cloudflare, AWS, GCP etc offerings are basically just one click and for smaller sites will be free. And over the years there have been many security flaws in how SQL libraries actually handle parameterisation.
- jiggawatts 3y agoThat "one click" instantly broke every single application I've seen it applied to. Eliminating false positives is a significant effort.
- MattPalmer1086 3y agoYep. If your developers actually use them consistently all the time. There's always someone who can't resist a bit of string concatenation...
- jiggawatts 3y agoThis is what code reviews are for.
- MattPalmer1086 3y agoYes, those are needed too. And static analysis and dynamic analysis, etc. Despite all of that we just found a SQL injection that existed for years somehow. Luckily the WAF blocked attempts to exploit it until we could issue a fix. Defence in depth is the win here.
- 1nd1ansumm3r 3y agoSometimes one has to host an application and has no control over the details of how that application is developed or configured related to parameterized SQL queries.