3 ms·
Did someone have a Bobby Tables moment? https://bobby-tables.com/ https://bobby-tables.com/ In Oracle, you can't use a bind variable in setting a password on
by chasil 3y ago
Did someone have a Bobby Tables moment?
https://bobby-tables.com/ https://bobby-tables.com/
In Oracle, you can't use a bind variable in setting a password on an account, so SQL injection is a more significant risk. I wrote some JavaScript and pl/sql to address that.
- javitury 3y agoI hope that javascript filter runs on the server and not on the web browser...
- chasil 3y agoThe php runs on the server, and does the same thing. The JavaScript posts excessive status messages, and only allows a submit when all checks have passed.
- Falmarri 3y agoDo you mean setting a database user account? As in the oracle user? Why is that exposed over the web?
- SoftTalker 3y agoThere is/was a school of thought that each user should have their own database account, and the application should connect to the database as that user. The advantage being you can use the database's built-in user and role management and privileges instead of having to invent your own. I have admittedly not seen this done much, but there is a certain appeal to it.
- d0gsg0w00f 3y agoI work for a company that is trying to bolt this functionality onto all the AWS database products. At least at the IAM role level. As it stands now, no human can write to a DB in prod-- only service accounts.