4 ms·

Actually they do sanitization by blacklisting "Blacklist sanitizing cleans the input by removing unwelcomed characters such as line breaks, extra white spaces,

Actually they do sanitization by blacklisting "Blacklist sanitizing cleans the input by removing unwelcomed characters such as line breaks, extra white spaces, tabs, &, and tags." But still this is not a way, input sanitization is bullshit. Using query parameters, thus inserting raw input into already built abstract syntax tree of SQL query is the correct solution since SQL injection is about affecting tree composition

skottk 3y ago
Parameterized SQL is your friend here.
- mysterydip 3y ago
  Yeah, that's what's mapped in my head to "sanitizing input" in these cases, as it's the correct way to handle them. I should've unrolled my brain shortcut for the discussion.
  - dylan604 3y ago
    Before Parameterized SQL was a thing, sanitizing was the thing. There’s a lot of escape_string() type of methods out there.
hobs 3y ago
You don't even have to do that, just escape single quotes and you've defeated everything but homomorphic attacks as far as I can tell.
- tester756 3y ago
  Why use unreliable solutions that rely on various assumptions that may change in the future and rely on you not forgetting about even 1 case where it wouldnt work When you can use approach which fundamentally prevents SQL injection?
  - hobs 3y ago
    I didn't say you should, I am just noting that there's no complexity in the solution required, it's simple and yet still many people don't do it.
- dylan604 3y ago
  That’s a comment that makes me think someone read a blog 15 years ago, and never kept up with modern ways of doing things.
  - hobs 3y ago
    Cool - but neither of your comments addressed that I am still correct afaict, if you care about query plans and such parameterization is important, but not getting injected on is a different problem.
    - dylan604 3y ago
      look, if you still want to live like it's 1999, then sure, go ahead and wrap your params in quotes like you think you can. just don't come crying to the rest of us that have more than once provided you with better solutions when you get attacked. i mean, even using the old style escape methods would be better than your appending of quotes idea.
      - hobs 3y ago
        I didn't say I don't use parameterization, and I still haven't heard what the difference is between the old style escape methods and the quotes I mentioned, just you being salty :)
reeeeaway 3y ago
Looking at the postgres JDBC source, it sanitizes parameters when prepared statements and parameterization is used. Different implementations may do different things here though
- tester756 3y ago
  Could you describe it conceptually how they do it?
  - reeeeaway 3y ago
    The method doAppendEscapeLiteral (Line 66) is a good example; https://github.com/pgjdbc/pgjdbc/blob/master/pgjdbc/src/main/java/org/postgresql/core/Utils.java#66 https://github.com/pgjdbc/pgjdbc/blob/master/pgjdbc/src/main... I didn’t take notes all the way down, but at the end of the day this method is invoked when a prepared statements’ parameters are being bound

skottk 3y ago

Parameterized SQL is your friend here.

mysterydip 3y ago
Yeah, that's what's mapped in my head to "sanitizing input" in these cases, as it's the correct way to handle them. I should've unrolled my brain shortcut for the discussion.
- dylan604 3y ago
  Before Parameterized SQL was a thing, sanitizing was the thing. There’s a lot of escape_string() type of methods out there.

hobs 3y ago

You don't even have to do that, just escape single quotes and you've defeated everything but homomorphic attacks as far as I can tell.

tester756 3y ago
Why use unreliable solutions that rely on various assumptions that may change in the future and rely on you not forgetting about even 1 case where it wouldnt work When you can use approach which fundamentally prevents SQL injection?
- hobs 3y ago
  I didn't say you should, I am just noting that there's no complexity in the solution required, it's simple and yet still many people don't do it.
dylan604 3y ago
That’s a comment that makes me think someone read a blog 15 years ago, and never kept up with modern ways of doing things.
- hobs 3y ago
  Cool - but neither of your comments addressed that I am still correct afaict, if you care about query plans and such parameterization is important, but not getting injected on is a different problem.
  - dylan604 3y ago
    look, if you still want to live like it's 1999, then sure, go ahead and wrap your params in quotes like you think you can. just don't come crying to the rest of us that have more than once provided you with better solutions when you get attacked. i mean, even using the old style escape methods would be better than your appending of quotes idea.
    - hobs 3y ago
      I didn't say I don't use parameterization, and I still haven't heard what the difference is between the old style escape methods and the quotes I mentioned, just you being salty :)

reeeeaway 3y ago

Looking at the postgres JDBC source, it sanitizes parameters when prepared statements and parameterization is used. Different implementations may do different things here though

tester756 3y ago
Could you describe it conceptually how they do it?
- reeeeaway 3y ago
  The method doAppendEscapeLiteral (Line 66) is a good example; https://github.com/pgjdbc/pgjdbc/blob/master/pgjdbc/src/main/java/org/postgresql/core/Utils.java#66 https://github.com/pgjdbc/pgjdbc/blob/master/pgjdbc/src/main... I didn’t take notes all the way down, but at the end of the day this method is invoked when a prepared statements’ parameters are being bound